SigmaHQ
Updated and Added rule related to Autorun Registry
Summary of the Pull Request
Updated and Added rule related to Autorun Registry
Changelog
new: Suspicious Autorun Registry Modified via WMI update: Suspicious PowerShell Invocations - Specific - PowerShell Module update: Suspicious PowerShell Invocations - Specific update: Potential Persistence Attempt Via Run Keys Using Reg.EXE update: New RUN Key Pointing to Suspicious Folder update: Suspicious Powershell In Registry Run Keys update: Direct Autorun Keys Modification update: Suspicious Run Key from Download
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions
- If your PR adds new rules, please consider following and applying these conventions
hello, Can you give me some references for the new run keys ? thanks Hi @frack113 , There are various references in the red canary's atomic red team, new tasks being registered under these new registry https://grep.app/search?f.repo=redcanaryco%2Fatomic-red-team&q=%5Csoftware%5Cmicrosoft%5Cwindows%5Ccurrentversion%5Cpolicies%5Cexplorer%5Crun https://github.com/HackTricks-wiki/hacktricks/blob/master/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md