SigmaHQ/rules/windows/sysmon/sysmon_sysinternals_sdelete_registry_keys.yml

28 lines
1021 B
YAML
Raw Normal View History

title: Sysinternals SDelete Registry Keys
id: 9841b233-8df8-4ad7-9133-b0b4402a9014
description: A General detection to trigger for the creation or modification of .*\Software\Sysinternals\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.
status: experimental
date: 2020/05/02
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
tags:
- attack.defense_evasion
- attack.t1070.004
references:
- https://github.com/OTRF/detection-hackathon-apt29/issues/9
- https://threathunterplaybook.com/evals/apt29/detections/4.B.2_59A9AC92-124D-4C4B-A6BF-3121C98677C3.html
logsource:
product: windows
service: sysmon
detection:
selection1:
EventID: 12
EventType: 'CreateKey'
TargetObject|endswith: '\Software\Sysinternals\SDelete'
2020-10-13 01:34:07 +00:00
selection2:
EventID: 13
EventType: 'SetValue'
TargetObject|contains: '\Software\Sysinternals\SDelete'
condition: selection1 or selection2
falsepositives:
- unknown
level: medium