Detection rules › Sigma

Non-privileged Usage of Reg or Powershell

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
Source
github.com/SigmaHQ/sigma

Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry

Event coverage

Rule body yaml

title: Non-privileged Usage of Reg or Powershell
id: 8f02c935-effe-45b3-8fc9-ef8696a9e41d
status: test
description: Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
references:
    - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-20-638.jpg
author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
date: 2020-10-05
modified: 2024-12-01
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        - CommandLine|contains|all:
              - 'reg '
              - 'add'
        - CommandLine|contains:
              - 'powershell'
              - 'set-itemproperty'
              - ' sp '
              - 'new-itemproperty'
    selection_data:
        IntegrityLevel:
            - 'Medium'
            - 'S-1-16-8192'
        CommandLine|contains|all:
            - 'ControlSet'
            - 'Services'
        CommandLine|contains:
            - 'ImagePath'
            - 'FailureCommand'
            - 'ServiceDLL'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_cli

selection_cli:
    - CommandLine|contains|all:
          - 'reg '
          - 'add'
    - CommandLine|contains:
          - 'powershell'
          - 'set-itemproperty'
          - ' sp '
          - 'new-itemproperty'

Stage 2: selection_data

selection_data:
    IntegrityLevel:
        - 'Medium'
        - 'S-1-16-8192'
    CommandLine|contains|all:
        - 'ControlSet'
        - 'Services'
    CommandLine|contains:
        - 'ImagePath'
        - 'FailureCommand'
        - 'ServiceDLL'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • sp
  • ControlSet corpus 3 (sigma 3)
  • FailureCommand corpus 3 (sigma 3)
  • ImagePath corpus 3 (sigma 3)
  • ServiceDLL
  • Services corpus 3 (sigma 2, splunk 1)
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
  • new-itemproperty corpus 7 (sigma 7)
  • powershell corpus 25 (sigma 24, chronicle 1)
  • reg corpus 5 (sigma 5)
  • set-itemproperty corpus 7 (sigma 7)
IntegrityLeveleq
  • Medium corpus 3 (sigma 3)
  • S-1-16-8192 corpus 3 (sigma 3)