detection.wiki

Detection rules › Sigma

Small Sieve Malware Registry Persistence

Status
test
Severity
high
Log source
product windows, category registry_set
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Small Sieve Malware Registry Persistence
id: 65c6e3c1-fb28-4c03-a51e-84919d8185f1
status: test
description: Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-19
modified: 2023-08-17
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection_path:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Run\'
    selection_value:
        - TargetObject|contains: 'Microsift'
        - Details|contains: '.exe Platypus'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_path

selection_path:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Run\'

Stage 2: selection_value

selection_value:
    - TargetObject|contains: 'Microsift'
    - Details|contains: '.exe Platypus'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • .exe Platypus
TargetObjectmatch
  • Microsift
  • \Microsoft\Windows\CurrentVersion\Run\