Potential Attachment Manager Settings Attachments Tamper

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects tampering with attachment manager settings policies attachments (See reference for more information)

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Attachment Manager Settings Attachments Tamper
id: ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a
status: test
description: Detects tampering with attachment manager settings policies attachments (See reference for more information)
references:
    - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
    - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-01
modified: 2023-08-17
tags:
    - attack.defense-impairment
logsource:
    category: registry_set
    product: windows
detection:
    selection_main:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\'
    selection_value_hide_zone_info:
        TargetObject|endswith: '\HideZoneInfoOnProperties'
        Details: 'DWORD (0x00000001)' # On
    selection_value_save_zone_info:
        TargetObject|endswith: '\SaveZoneInformation'
        Details: 'DWORD (0x00000002)' # Off
    selection_value_scan_with_av:
        TargetObject|endswith: '\ScanWithAntiVirus'
        Details: 'DWORD (0x00000001)' # Disabled
    condition: selection_main and 1 of selection_value_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection_main and 1 of selection_value_*

Stage 1: `selection_main`

selection_main:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\'

Stage 2: `selection_value_hide_zone_info`

selection_value_hide_zone_info:
    TargetObject|endswith: '\HideZoneInfoOnProperties'
    Details: 'DWORD (0x00000001)'

Stage 3: `selection_value_save_zone_info`

selection_value_save_zone_info:
    TargetObject|endswith: '\SaveZoneInformation'
    Details: 'DWORD (0x00000002)'

Stage 4: `selection_value_scan_with_av`

selection_value_scan_with_av:
    TargetObject|endswith: '\ScanWithAntiVirus'
    Details: 'DWORD (0x00000001)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000001)` corpus 40 (sigma 36, chronicle 4) `DWORD (0x00000002)` corpus 10 (sigma 9, chronicle 1)	`field:"Details" kind:eq`
`TargetObject`	ends_with	`\HideZoneInfoOnProperties` `\SaveZoneInformation` `\ScanWithAntiVirus`	`field:"TargetObject" kind:ends_with`
`TargetObject`	match	`\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\`	`field:"TargetObject" kind:match value:"\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\"`

Potential Attachment Manager Settings Attachments Tamper

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_main

Stage 2: selection_value_hide_zone_info

Stage 3: selection_value_save_zone_info

Stage 4: selection_value_scan_with_av

Indicators

Stage 0: `condition`

Stage 1: `selection_main`

Stage 2: `selection_value_hide_zone_info`

Stage 3: `selection_value_save_zone_info`

Stage 4: `selection_value_scan_with_av`