detection.wiki

Detection rules › Sigma

Small Sieve Malware Registry Persistence

Status
test
Severity
high
Log source
category registry_set, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 13: RegistryEvent (Value Set)

Rule body

title: Small Sieve Malware Registry Persistence
id: 65c6e3c1-fb28-4c03-a51e-84919d8185f1
status: test
description: Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-19
modified: 2023-08-17
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection_path:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Run\'
    selection_value:
        - TargetObject|contains: 'Microsift'
        - Details|contains: '.exe Platypus'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_path

selection_path:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Run\'

Stage 2: selection_value

selection_value:
    - TargetObject|contains: 'Microsift'
    - Details|contains: '.exe Platypus'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Detailsmatch
  • .exe Platypus
field:"Details" kind:match value:".exe Platypus"
TargetObjectmatch
  • Microsift
  • \Microsoft\Windows\CurrentVersion\Run\
field:"TargetObject" kind:match