From 6b3b9e924f7b6538099d4eb8122d9004ce2b9082 Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 1 Feb 2022 14:21:48 +0100 Subject: [PATCH 1/2] Fix GPO FP --- .../sysmon_wdigest_enable_uselogoncredential.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml b/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml index 6a53796b6..40281537d 100644 --- a/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml +++ b/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml @@ -10,12 +10,15 @@ tags: - attack.t1112 references: - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html + - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649 logsource: category: registry_event product: windows detection: selection: + EventType: SetValue TargetObject|endswith: 'WDigest\UseLogonCredential' + Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown From ca8aa9bb6240393b598c1e07c5e293f8080c23d5 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Tue, 1 Feb 2022 15:59:20 +0100 Subject: [PATCH 2/2] fix: missing update in modified date --- .../registry_event/sysmon_wdigest_enable_uselogoncredential.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml b/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml index 40281537d..93eb30787 100644 --- a/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml +++ b/rules/windows/registry_event/sysmon_wdigest_enable_uselogoncredential.yml @@ -3,7 +3,7 @@ id: d6a9b252-c666-4de6-8806-5561bbbd3bdc description: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials status: experimental date: 2019/09/12 -modified: 2021/05/27 +modified: 2022/02/01 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) tags: - attack.defense_evasion