Suspicious Keyboard Layout Load

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only

Known false positives

Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1588.002` Obtain Capabilities: Tool

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Suspicious Keyboard Layout Load
id: 34aa0252-6039-40ff-951f-939fd6ce47d8
status: test
description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
references:
    - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
    - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
author: Florian Roth (Nextron Systems)
date: 2019-10-12
modified: 2023-08-17
tags:
    - attack.resource-development
    - attack.t1588.002
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'
detection:
    selection_registry:
        TargetObject|contains:
            - '\Keyboard Layout\Preload\'
            - '\Keyboard Layout\Substitutes\'
        Details|contains:
            - 00000429  # Persian (Iran)
            - 00050429  # Persian (Iran)
            - 0000042a  # Vietnamese
    condition: selection_registry
falsepositives:
    - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)
level: medium

Stages and Predicates

Stage 0: `condition`

selection_registry

Stage 1: `selection_registry`

selection_registry:
    TargetObject|contains:
        - '\Keyboard Layout\Preload\'
        - '\Keyboard Layout\Substitutes\'
    Details|contains:
        - 00000429
        - 00050429
        - 0000042a

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`00000429` `0000042a` `00050429`	`field:"Details" kind:match`
`TargetObject`	match	`\Keyboard Layout\Preload\` `\Keyboard Layout\Substitutes\`	`field:"TargetObject" kind:match`