detection.wiki

Detection rules › Sigma

Windows Recall Feature Enabled Via Reg.EXE

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Sajid Nawaz Khan
Source
github.com/SigmaHQ/sigma

Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.

MITRE ATT&CK coverage

TacticTechniques
CollectionT1113 Screen Capture

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Windows Recall Feature Enabled Via Reg.EXE
id: 817f252c-5143-4dae-b418-48c3e9f63728
related:
    - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62
      type: similar
    - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4
      type: similar
status: test
description: |
    Detects the enabling of the Windows Recall feature via registry manipulation.
    Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
    Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
    This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
references:
    - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
    - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
author: Sajid Nawaz Khan
date: 2024-06-02
tags:
    - attack.collection
    - attack.t1113
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_value:
        # HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        # HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        CommandLine|contains|all:
            - 'Microsoft\Windows\WindowsAI'
            - 'DisableAIDataAnalysis'
    selection_action_add:
        CommandLine|contains:
            - 'add'
            - '0'
    selection_action_delete:
        CommandLine|contains: 'delete'
    condition: selection_img and selection_value and 1 of selection_action_*
falsepositives:
    - Legitimate use/activation of Windows Recall
level: medium

Stages and Predicates

Stage 0: condition

selection_img and selection_value and 1 of selection_action_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: selection_value

selection_value:
    CommandLine|contains|all:
        - 'Microsoft\Windows\WindowsAI'
        - 'DisableAIDataAnalysis'

Stage 3: selection_action_add

selection_action_add:
    CommandLine|contains:
        - 'add'
        - '0'

Stage 4: selection_action_delete

selection_action_delete:
    CommandLine|contains: 'delete'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • 0 corpus 5 (sigma 5)
  • DisableAIDataAnalysis
  • Microsoft\Windows\WindowsAI
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
  • delete corpus 23 (sigma 16, splunk 6, kusto 1)
Imageends_with
  • \reg.exe corpus 58 (sigma 58)
OriginalFileNameeq
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)