2020-10-12 22:13:13 +00:00
title : Sysinternals SDelete Registry Keys
id : 9841b233-8df8-4ad7-9133-b0b4402a9014
description : A General detection to trigger for the creation or modification of .*\Software\Sysinternals\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.
status : experimental
date : 2020 /05/02
author : Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
tags :
- attack.defense_evasion
- attack.t1070.004
references :
- https://github.com/OTRF/detection-hackathon-apt29/issues/9
- https://threathunterplaybook.com/evals/apt29/detections/4.B.2_59A9AC92-124D-4C4B-A6BF-3121C98677C3.html
logsource :
product : windows
service : sysmon
detection :
selection1 :
EventID : 12
EventType : 'CreateKey'
TargetObject|endswith : '\Software\Sysinternals\SDelete'
2020-10-13 01:34:07 +00:00
selection2 :
2020-10-12 22:13:13 +00:00
EventID : 13
EventType : 'SetValue'
TargetObject|contains : '\Software\Sysinternals\SDelete'
condition : selection1 or selection2
falsepositives :
- unknown
level : medium