From 797bcaebfeecfa154c5b912b3cd1d7ba159da505 Mon Sep 17 00:00:00 2001 From: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Date: Tue, 28 Apr 2026 07:45:16 +0545 Subject: [PATCH] Merge PR #5900 from @swachchhanda000 - Update Important scheduled task manipulation related rules update: Important Scheduled Task Deleted or Disabled - Add EventID 142. update: Disable Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Delete Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. new: System Restore Registry Modification via CommandLine chore: add regression tests for Important scheduled task manipulation rules --------- Co-authored-by: Nasreddine Bencherchali --- .../7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx | Bin 0 -> 69632 bytes .../7595ba94-cf3b-4471-aa03-4f6baa9e5fad.json | 54 ++++ .../info.yml | 13 + .../9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx | Bin 0 -> 69632 bytes .../9e3cb244-bdb8-4632-8c90-6079c8f4f16d.json | 48 ++++ .../info.yml | 13 + .../7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.evtx | Bin 0 -> 69632 bytes .../7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json | 264 ++++++++++++++++++ .../info.yml | 13 + .../dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.evtx | Bin 0 -> 69632 bytes .../dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json | 66 +++++ .../info.yml | 13 + .../9ac94dc8-9042-493c-ba45-3b5e7c86b980.evtx | Bin 0 -> 69632 bytes .../9ac94dc8-9042-493c-ba45-3b5e7c86b980.json | 66 +++++ .../info.yml | 13 + .../5de03871-5d46-4539-a82d-3aa992a69a83.evtx | Bin 0 -> 69632 bytes .../5de03871-5d46-4539-a82d-3aa992a69a83.json | 208 ++++++++++++++ .../info.yml | 13 + ..._susp_scheduled_task_delete_or_disable.yml | 10 +- ...duler_susp_schtasks_delete_or_disable.yml} | 22 +- ...on_win_reg_system_restore_modification.yml | 51 ++++ .../proc_creation_win_schtasks_delete.yml | 15 +- .../proc_creation_win_schtasks_disable.yml | 24 +- .../registry_set_disable_system_restore.yml | 9 + 24 files changed, 893 insertions(+), 22 deletions(-) create mode 100644 regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx create mode 100644 regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.json create mode 100644 regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml create mode 100644 regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx create mode 100644 regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.json create mode 100644 regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.evtx create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.evtx create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/9ac94dc8-9042-493c-ba45-3b5e7c86b980.evtx create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/9ac94dc8-9042-493c-ba45-3b5e7c86b980.json create mode 100644 regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml create mode 100644 regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.evtx create mode 100644 regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.json create mode 100644 regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml rename rules/windows/builtin/taskscheduler/{win_taskscheduler_susp_schtasks_delete.yml => win_taskscheduler_susp_schtasks_delete_or_disable.yml} (61%) create mode 100644 rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml diff --git a/regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx b/regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx new file mode 100644 index 0000000000000000000000000000000000000000..5c5ad4920aa1f419a02232b44dfd7fa0fb13aaaf GIT binary patch literal 69632 zcmeI0TWlOx8OOi9db76IF^Nk-Y3fF#BrT3}X;52l930!5SdCNTOVdi>!S(ul zO-gu(pcR*g3M4>CeE}o{5fu^=NGRd~303M-kx(U2KuCQ-tyCcbs%XW7`Tx(E@y=|# zj@{%5{l^;b%$)Ch=R3dea?Z?PWu`P=nYQ{P89ca#-=w9?b|&gY?)tv(qyP5awGt^1 z0TB=Z5fA|p5CIVo0TB=Z5fA|pxFdnV%1r;<;w1~;?i>AHqb7V5nENEo`M*DZN5yv# z;5aSCLhSwjfvnm4O=kbjn7x~hE7+YgJAuy-+dba8L!WPAOdbzlOdkIU8@WVA|+-pnu9m<_C=_e1hRQdf8Lou zbcM8KlZBLJ(}`x=hX-M#-@l{Do(aU}L240g$wITG)5y8KxCukN{8q-!LXf_yI3c4@ z()QqHPY|brSJO7`d~wN%BspNhI&s4k;PH#SS$i4|q+5uH!zHLGW1qoIm^l~!kh7=I z{1W_D1;;YDQ#4~8X<#40&36KgJ+C%n(0RwSAEMJRfG#RS#^GTWF{X-F^Dz&Goq#86 z?Wsf_(Ne1=rBrK#_9zt6WLo0MCkuJY)0S7zDJ%#-{#Ud0J2Bc(ah8NwFF>wT3Nk!@ zD{pRQ!B$|ZEXQ#ghk{xzutifTyci4 zx`DiV&(IEd(`ZZnPdkE`or2&p{sJp?X*NXv9?x(0IM1u*Rz;&pcW7cG|uNrGLvY53765IiOtjND&q-R zpMr|82>G|l*-o3X@{PTB64@$vHzrrQgRUQLh zWeA1kdBBD9B%ZVK4dR#UEF+!Q}vRp&ojKFSIINBVy!S_Y=VBZbx zA9dBg9~vt7i&{a>Q|`IX=42~M4E2y1Nw?QHq^*RtZUCHbEa}&YEWE%a)P~nSqGT7>Lx^!EDgkLvK zpuQf#!gLtFosPI)Ieq4{bplaTLY+8*t;Rm+>9tnOwzwW!osmrx!gaNJle=Mh1kUoU*| zq#b}idhmBT`0WAH=j`AH&rd<3_Phj}O7^Vl+k@TB7}|=ke`_O?GA#|Qt-5uHx!8-X z%mMoX3gL3Z@7$JFVfTLcJo@|?wxoQrgg?*b5MqzH@i};vt%uj`ijENsru9mnBHE*3q&EYO$uV@@@ zCKnyuYYkU_?w?lN+(O;;QLve0R4-#O)Uo-zioyPS0<#Fe50t^ee?%#}xbhjmd9teU z9WFjwUp2O?A#U%miH4tRmm|+Fs9QqxPs4TDsl2`%2R&TDi+3k6HYY%rbT(-5?W= zT0~y@j||*tv9-(0-_aOHTpOa_I+)?nsAiQNLzIkQ{@iufcAwH0Q458vy0t;n}Sym5^0#;gAcUK_04_zQ\r\n\r\n \r\n D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;FRFX;;;LS)\r\n $(@%systemroot%\\system32\\srrstr.dll,-320)\r\n $(@%systemroot%\\system32\\srrstr.dll,-321)\r\n $(@%systemroot%\\system32\\srrstr.dll,-322)\r\n Microsoft\\Windows\\SystemRestore\\SR\r\n \r\n \r\n \r\n S-1-5-18\r\n \r\n \r\n \r\n true\r\n false\r\n false\r\n IgnoreNew\r\n true\r\n true\r\n \r\n true\r\n false\r\n \r\n true\r\n \r\n P3D\r\n P3DT1M\r\n true\r\n \r\n \r\n \r\n \r\n \r\n %windir%\\system32\\srtasks.exe\r\n ExecuteScheduledSPPCreation\r\n \r\n \r\n", + "ClientProcessStartKey": 2251799813691708, + "ClientProcessId": 5204, + "ParentProcessId": 15816, + "RpcCallClientLocality": 0, + "FQDN": "swachchhanda" + } + } +} diff --git a/regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml b/regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml new file mode 100644 index 000000000..d1b5c5373 --- /dev/null +++ b/regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml @@ -0,0 +1,13 @@ +id: fbeed033-1556-49ae-881d-1e12e8aceb49 +description: N/A +date: 2026-03-11 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +rule_metadata: + - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad + title: Important Scheduled Task Deleted/Disabled +regression_tests_info: + - name: Positive Detection Test + type: evtx + provider: Microsoft-Windows-Sysmon + match_count: 1 + path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/7595ba94-cf3b-4471-aa03-4f6baa9e5fad.evtx diff --git a/regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx b/regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.evtx new file mode 100644 index 0000000000000000000000000000000000000000..ed7d4507f8e062d4abfaea5bf8ad2306a0a85bd4 GIT binary patch literal 69632 zcmeI$S!i5U90u_Jow+laOlBrajZ3UGZEdwmTeWUAwHlL*ji!r9+%P`GX41xHDVe0E zRxr3A3Kj(w#g`%#6-4kskf0ALq7R}Vf}%zAL0ldL6>)nQzwg|8JDD-H)%f_`aA)pv zw);Eh{LjsFjSlBWMhjNG#lj1-_>NiJtih{Jvgq^n-~Zga=t5M01SB8<2}nQ!5|Drd zBp?9^NI(L|73dlr?$|xP$D;r4kM%vvlJKLzRkda{Uv_Wh>0&n4bI;0;TIQE=M$&9` z%IxQa*|+}uJ7z^(zXCr){M+q=*Rpl_vf7wyFIJqzyi)07^i|Yv6a7i+v;8P}%GHPg-d-x* zf_6nc`s0C=?Qpg4LtR5iHHo{IV9!T`@wz8`+lI!D;ig$GXI}E=a6GJO_U#&*b~$mY z-sR*Xm zXDe_a8tJFj*4T|U5DHI(QgxQ9D+NO zCal>9`wpBu7M9p{unv`uIMWU!EuaDHq9LSlJe)-wQ=1N?D|#@>1fHZd#=SH~OF5S0 zOU8DLx|T$&14x(8hci6=W7^tL;uIRr z(K3Z64a&{cSbdT~f!%)bJB`MwgOd16$HP)8I*UVF6`4>02zKJ6+Bx_1lP zf!;K>CH+ZlIA(VuVG(~}D^iw9GPJU5AJ~|J@b1ty0?5@`D(*G7;lyCf?LG|A4x}8! zKpJ=LW~Vin=X<5nCL~}~W5>0PrySH6h5{QG%#~Qe%b*E&B0ncK_n@pHT%q;VC?X2N zht{Rgo$Qurv@9SrI}<6AQ9K^*N!kr4kfn#um9ZspKi6o>eQQEe3_Z7Fq+-Deo+4$< zma<0N#Sq64_mrhwI%Id(H{-0q>M?gb%X`a_<{#aBOBrdR*O0VLOD>ApvdpY=` zz~1SK9mMtJ*prNg?CB^}bfU&0lHBf|ZO8@IjY!C4oCEdY2_M0ZEn^X!Rk1vJGJ}0!fsPrd>X?CwIKm0aRe{l=fc$-! zvXv`^#j-xv%~ELtYHC8WR+S$jhsGDs-@(!mO~Y~%6Tt(ug*n%jb2j1eC-CrGJ-eLU zKBpA)Uq3?1UfhdilR*h zBO0$2@tKEdaFy%Eqzg}cMT<-r+I#S{9WdxY`aaC6UWE8=TY0} z9NmIDUstt#eiUC=B&eS&0E0)_By39qIusjTZD;Dt_}={`g47FRyolgAxANZ8{`TIz z(0azm7OiIuIIdpLSQG>58oLB1B|)+jnfMX6_Bx84 zG$9g-pcS+qcu1hO1c{0-kbolc0ja7YAt6=e0|Wt;D6bF%A3#D#1yvvwF#rF|z22-J zi9=(xRR3$;y?18L%$)hnnR8}t(lhu?G~ zYCr@;KmYKmuHwaw4}#U~EGanI%71l2)cRl&7gfBjb66W=%g`TXF9-@p3GxeK-5{31p| zsjgak0^k;FW9*qjGR447UP1z(0XHbv~TJ0FbX6?A`wC(tt zv7^Wth0HMC8}OV!&Iy}FYTCvi*?{yk^0(XLC@bLEWIOQJg0~&kf#1>j?q^C;VK6uM z3g#-Fx9Ni^J78zf@~rC-U%I;H<~|O+;u(GIY})p_-cO;g5lEdtX&df*Y>fN9lCX!N z>=X*kaybi9ha-E~QkSp??WC)TqH3!y>ngJWh@HwS zN!x@(ymB7>N!s?I_zdQ48XQN!ouWyrO91!K_Zx&djJCTYMi)Tg|q`T1yi7MeyxPb zpb9EHj{02KynS0E$RX=)G!Z-D=Nr&xwngSTg>=D=bR0jl^#|8` zzTcmEec}sm{PK3|Z+GjCD7ZenRnk*<=l!X@vmJ5B;CtoKT}Oh4o_hJ;k6c`H4HHHw z%;C@Q%Bah$_tP}6*m?K5W`~hazu1WFES~6+30=J-Ac!hshuf+dc^mM(2HE zn8lQEqTe6Ye|J&398)<9V)3#Kv(SjL+ag&v^}glG1x6h^)-W4dHS27N>b$qu{^Er& zVqvz-(v)8x$#eE2?UOJm2A*-~A7)`j%j%K`ZH}_k(T3UNP3rVQp5cv_eSCht!ffg$ ze0=a30aH4bFk5~TS$ZihKCaX=kWG8p_Gp~s6OFS5c0(=3aTg#zY4LdCNET)*ZZZ-m;pb z5wOo_1UXn1$2|)DV$W8Ly9720GSy$t88%56PIYx12Zx z6nWg`d9+47xp3-NST$DIa`pZA?)KwbW_1?p-nfd^tWe+OY^u)J=UmV#a0H2&W=iyp zgF={n7iuJoZYG2)Z;0GFU49$h^SHO-rkm#z8#cR+do%7$xETT%E_{f947?=s;`)@Q z+%~uEY(kscur?e;Z5SgO!E*yYl(1g{}j1xLV0%-!+~au)Zzka|7h z)j`)<@i;K(YJ2}QiazUcm^kHnr}vtHHlJ{$Xt@QqHy@9rW}OtZdC-o)*Bye6gLwKj z{0JJO)YyuxV7Xn?5Uheb?+N$_TG`jXeQ~^h4Z<<5_!;1R4Ex23pdq3FkL0%J5ZD_9#Z=HDWLydOi z!JoX_vnzW3$C!hLVt zU%cq}EB^!yArxZwBc|7-B{;oR)USH@P+|NnZC|Bw5N{r~UYng0JTtLp!`&*+@@|6h&# z|CcM}|5xV(u=4$W=~s!;uQ{bBF`WjQ+})m)z3RKxt~lX9N0wT_PX?A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ qA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wVBsB=BE1tuJZ- literal 0 HcmV?d00001 diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json b/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json new file mode 100644 index 000000000..121aeb0c2 --- /dev/null +++ b/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.json @@ -0,0 +1,264 @@ +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 1, + "Version": 5, + "Level": 4, + "Task": 1, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:43:26.345335Z" + } + }, + "EventRecordID": 35549, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "UtcTime": "2026-03-11 05:43:26.311", + "ProcessGuid": "0197231E-00FE-69B1-981A-000000000800", + "ProcessId": 376, + "Image": "C:\\Windows\\System32\\reg.exe", + "FileVersion": "10.0.26100.1 (WinBuild.160101.0800)", + "Description": "Registry Console Tool", + "Product": "Microsoft® Windows® Operating System", + "Company": "Microsoft Corporation", + "OriginalFileName": "reg.exe", + "CommandLine": "reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f", + "CurrentDirectory": "C:\\Windows\\System32\\", + "User": "swachchhanda\\xodih", + "LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000", + "LogonId": "0x3144c", + "TerminalSessionId": 1, + "IntegrityLevel": "High", + "Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0", + "ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800", + "ParentProcessId": 15816, + "ParentImage": "C:\\Windows\\System32\\cmd.exe", + "ParentCommandLine": "cmd.exe", + "ParentUser": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 1, + "Version": 5, + "Level": 4, + "Task": 1, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:43:26.390084Z" + } + }, + "EventRecordID": 35550, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "UtcTime": "2026-03-11 05:43:26.378", + "ProcessGuid": "0197231E-00FE-69B1-991A-000000000800", + "ProcessId": 12068, + "Image": "C:\\Windows\\System32\\reg.exe", + "FileVersion": "10.0.26100.1 (WinBuild.160101.0800)", + "Description": "Registry Console Tool", + "Product": "Microsoft® Windows® Operating System", + "Company": "Microsoft Corporation", + "OriginalFileName": "reg.exe", + "CommandLine": "reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f", + "CurrentDirectory": "C:\\Windows\\System32\\", + "User": "swachchhanda\\xodih", + "LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000", + "LogonId": "0x3144c", + "TerminalSessionId": 1, + "IntegrityLevel": "High", + "Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0", + "ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800", + "ParentProcessId": 15816, + "ParentImage": "C:\\Windows\\System32\\cmd.exe", + "ParentCommandLine": "cmd.exe", + "ParentUser": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 1, + "Version": 5, + "Level": 4, + "Task": 1, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:43:26.438522Z" + } + }, + "EventRecordID": 35551, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "UtcTime": "2026-03-11 05:43:26.429", + "ProcessGuid": "0197231E-00FE-69B1-9A1A-000000000800", + "ProcessId": 2964, + "Image": "C:\\Windows\\System32\\reg.exe", + "FileVersion": "10.0.26100.1 (WinBuild.160101.0800)", + "Description": "Registry Console Tool", + "Product": "Microsoft® Windows® Operating System", + "Company": "Microsoft Corporation", + "OriginalFileName": "reg.exe", + "CommandLine": "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f", + "CurrentDirectory": "C:\\Windows\\System32\\", + "User": "swachchhanda\\xodih", + "LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000", + "LogonId": "0x3144c", + "TerminalSessionId": 1, + "IntegrityLevel": "High", + "Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0", + "ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800", + "ParentProcessId": 15816, + "ParentImage": "C:\\Windows\\System32\\cmd.exe", + "ParentCommandLine": "cmd.exe", + "ParentUser": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 1, + "Version": 5, + "Level": 4, + "Task": 1, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:43:27.502020Z" + } + }, + "EventRecordID": 35552, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "UtcTime": "2026-03-11 05:43:27.480", + "ProcessGuid": "0197231E-00FF-69B1-9B1A-000000000800", + "ProcessId": 13620, + "Image": "C:\\Windows\\System32\\reg.exe", + "FileVersion": "10.0.26100.1 (WinBuild.160101.0800)", + "Description": "Registry Console Tool", + "Product": "Microsoft® Windows® Operating System", + "Company": "Microsoft Corporation", + "OriginalFileName": "reg.exe", + "CommandLine": "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f", + "CurrentDirectory": "C:\\Windows\\System32\\", + "User": "swachchhanda\\xodih", + "LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000", + "LogonId": "0x3144c", + "TerminalSessionId": 1, + "IntegrityLevel": "High", + "Hashes": "MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0", + "ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800", + "ParentProcessId": 15816, + "ParentImage": "C:\\Windows\\System32\\cmd.exe", + "ParentCommandLine": "cmd.exe", + "ParentUser": "swachchhanda\\xodih" + } + } +} diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml b/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml new file mode 100644 index 000000000..91d85277a --- /dev/null +++ b/regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml @@ -0,0 +1,13 @@ +id: 75a7a650-1934-4994-9447-addc8cea2c50 +description: N/A +date: 2026-03-11 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +rule_metadata: + - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 + title: System Restore Registry Modification via CommandLine +regression_tests_info: + - name: Positive Detection Test + type: evtx + provider: Microsoft-Windows-Sysmon + match_count: 4 + path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/7c06ab9b-b1d2-4ba9-b06e-09491ded20d9.evtx diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.evtx b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.evtx new file mode 100644 index 0000000000000000000000000000000000000000..12fcdcd528e521d3dba0d087d217507ab4d0dd97 GIT binary patch literal 69632 zcmeI0U2I%O701uL`{DK4yKA>`DWM5Y+Cmbrm{KMn10YAS*k31?QCPO zqu6O1f=~p6(n`?sfP&Nq5K`3-P^3N}p{i0PBm_@Is*3m!sz68xUMfme0jetV|Igg( zYrD3S&?lt-UCr*y+%sp+{LYy(V~@_w)EaYjTmOVn$3^^xmNM%I){A`L_V9n+{nQ6m zA_XEK0wN#+A|L`HAOa#F0wN#+A|L`+B``WSQ#sW<(~c3@6E|BB>) z67{q1Y4pvkv*%8<{~i64Wc#`~<|ADk`+QVC3E3KSzO+scWv=!4OG_g8vG^Y}N!R~W z+qVxsE!m3yr`~(}&FwG#F(?IrwFhq;ee=0^Cf4`-{pq`R|M_>XUwppv*{84)N)30~ zH&EpQ`MlJgu~B>2>ejR+v>!vsJ`}xtxsck5Ndrki0}H!^owg+VX(aXI(!xT zZQ8m*>WE2YR7Bp^&;&k*v+U|9}IPFA2P8e7>8r%YWuI$X(=ixxQg@`y^KusCD4UKr` zJoM|F-G$fZ;kN~FoCbG_W~?g>?Bi&BH_~|YJ8hV>;h0t+T89C2(KKWn9_}K>)EyV{ zYdjba0-mgOrh+`8CCMeVRACkEyP=RK(-KcUEaojwTP|TxoDhEW&o-+#G1@WbEQzsB zK(1Dcc6k1+ybVL+5)5awEMcWyZ?VNnStbR#z5I(#fo_c^-4bN#tig zZN&l}b%vjF6M6R@rycO7(U$ygTcenrg5V-Pkrg@1Wtm#(+Dk(@5Iz;LjR6!}Etd*9 zTsScq^Z7bLv;xUV1X9!4O{aBOkPeoY?|=Za8Xb4EnRB4#5ehWU@0BnUw8Ml)FrFKm z#p{|z4_S{uMVy3x*qehp>6UY_%p)}WC?v9RKAsuN+I>(+?a{j0?Z#BP*lD}cb^}Ba zdafW+abWpX>J@%!!8T~14U8rsD;FMg}t>}4qZ z>l1DeGMJaiaO#t=d2O=lvHQ{2gqIhWQVn_{dvj8gF7YpC+n-FCfcx&*%8X zHk`5I_B3-S?*&ziVV$dD3Z}hnel&f~IOA@O>`kw1`LNLLr8e~T7E&}A(LNYZ+s|(g_|%UZA>#EQh9Hb z)|v7@jd~4b1chmSAIi-rUqRV}avKVd03H|qh=2^TB>UJNz3Osu)k^kbF@ z_?_n_lkK9NM(IT?@D@P5)ZYuK0oP)kR_uwij$qd@Q%$@6fykBvZqy)JeYO{o?e%tJ zX3oPqiO=C@p^1KJx|`>$+ri06(~Xe}_{?o^?p?viwI?5YcuP!9t0wjW=S(i(??3fj8PkDoGzz2+$AN=@**|BXnR`JBY0qVygF$2J8_`^ literal 0 HcmV?d00001 diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json new file mode 100644 index 000000000..01e6324b7 --- /dev/null +++ b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json @@ -0,0 +1,66 @@ +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 1, + "Version": 5, + "Level": 4, + "Task": 1, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:50:15.050582Z" + } + }, + "EventRecordID": 35558, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "UtcTime": "2026-03-11 05:50:15.010", + "ProcessGuid": "0197231E-0297-69B1-A51A-000000000800", + "ProcessId": 3824, + "Image": "C:\\Windows\\System32\\schtasks.exe", + "FileVersion": "10.0.26100.1 (WinBuild.160101.0800)", + "Description": "Task Scheduler Configuration Tool", + "Product": "Microsoft® Windows® Operating System", + "Company": "Microsoft Corporation", + "OriginalFileName": "schtasks.exe", + "CommandLine": "schtasks /delete /f /tn \"\\Microsoft\\Windows\\SystemRestore\\SR\"", + "CurrentDirectory": "C:\\Windows\\System32\\", + "User": "swachchhanda\\xodih", + "LogonGuid": "0197231E-AB9F-67AA-4C14-030000000000", + "LogonId": "0x3144c", + "TerminalSessionId": 1, + "IntegrityLevel": "High", + "Hashes": "MD5=F6A8EAD7A0201CD4B70BC27880EF5D90,SHA256=50D05E4D9CACE1FE8620CE95DDEA9978B26987787A0FFBCFEF4C25381DB9BB79,IMPHASH=15B98131447F3FE7853021D3B8BDBE26", + "ParentProcessGuid": "0197231E-5098-69AE-5814-000000000800", + "ParentProcessId": 15816, + "ParentImage": "C:\\Windows\\System32\\cmd.exe", + "ParentCommandLine": "cmd.exe", + "ParentUser": "swachchhanda\\xodih" + } + } +} diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml new file mode 100644 index 000000000..a26c8b222 --- /dev/null +++ b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml @@ -0,0 +1,13 @@ +id: 26749dc2-d5d4-4e6e-917a-b21be70dde32 +description: N/A +date: 2026-03-11 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +rule_metadata: + - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 + title: Delete Important Scheduled Task +regression_tests_info: + - name: Positive Detection Test + type: evtx + provider: Microsoft-Windows-Sysmon + match_count: 1 + path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.evtx diff --git a/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/9ac94dc8-9042-493c-ba45-3b5e7c86b980.evtx b/regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/9ac94dc8-9042-493c-ba45-3b5e7c86b980.evtx new file mode 100644 index 0000000000000000000000000000000000000000..ccc4fcd199d252a2b320865ba19ff618ceb0b4f4 GIT binary patch literal 69632 zcmeI1U2I%O701uL`{DK4yKA>Gl+pwzEzp?SvE!^iNCVirUJ`0UXcJl_i(<02v(0)P zWt}Ez5Q>1Rv`A1M5Ji0e@d7OC>L35ZYy;sJO;DyRZfA@l#w-0QVn z+ezsQ5C6NmyYq48%$eUgb7ta9)fXzY`n+v^!l>a2enU%`bp@M6-g157->-k*Eh~`% z5fA|p5CIVo0TB=Z5fA|p5CIVof$I{OsxOpIH_ll6ulwzOuTT^IDDYIb*|q)`e|}xX z*Ad`6CqMPsZ>|^Hoi@v6%>I!w`%7|tkJ&-AAHkm?-t6EhUDqVf!6E71A;COwq7(dSQXEy?%9f1qhK{ZFO7 zKKQg?YyQ9X(`%3HdG7Z?AqcE9c;)clz8BBL@|}Nu`rdti{O!wEp6UMXlUNC*Cc5p5 zC~|>(p6^WAls#dyDYVQ( zW)9^6{MOKN&X!SIwgpHIpuUXu19ky@4g4OoL3|FOG-zY^o?n~3xuF&YtE(@=SFzug zPo(WWy9CWEZbk(7#OmrNVOQ+YS1)JmxSRc9%vFWdIrNU;t;E52&)1XoQ5d^~PP2U8 zg7gDXJnZjD+K27D8;P!h6%rE(n}OIPk;H3rZR=nivoiYLi#N@XqniEKvi5PPm;Dml`clfKAxK}< zosdx|wA)a*EsE2r%Sk)od~wE!gq$$2UR1aR_*~tSwvWMqbPEx2x`3Keb_Xi)&Uxrp z8M_DFm*BT$aIAtmMN`(31oq>od@a&=_$wWlwC0$WAUY2N=%OlQ93Ji>#?;-Hvl~1Z z4+5UFbti%>qNSBfDv8`W+V?^sO{OKDe3;K#mbN^KL2*L(&fhz%gp2ah?B^Ve%Ou$ zTy%z?cN2N{9;F@drqPz{Z`z}nJq5ugK9Lm}%cPlF>DoufGa!6AVjBa7cib1o3GbZ zMGIL^LPeZ}zdewFJL#75u*@Sgdlw|qaXwy{PTNT+r1ofCopy5~neVo}NxKQ62tD^A zQgLAURb;HkGKQlIPZA}*8Ou6340r8=sC8Mvj^g*n?R%Y;_%yUDabEmVr`Zco+V^EQ z2pP=Fq&W2qY~Glx`t5$SHQ?oCFlbtT6s}9CH|)W&v-kJ?><^`%Os8L~ef9O%%F0=y2?2pF0v!(xy8=-1pE@2tU?~UZ?{mA+h zLW&2^BJ2-y2%~Lnsem?DxiQg(xzrA0%8=*r#>hUq=C3f9-hq!le5zo|#1iJ(c93P3 z;^yN{y#(2emmQ7PNj}j!yAU_DVi9ix@^y>X6Q5*Zu6>7<_?bwGkv;9SkQg=;iETM! z$?a+8P~Hp57{fAG#S~0?JN#(+oN>n88rhp%+wx(q(@SmX?P=&*bUUjR9Y~|JY0Kzq z$sfZy!d%`TMRBCRuVq0uVwC%g*AY*Qd5X!^?>axe;3I1|S^?*bR**+zaozK0r9ag{& z+itvH-_3q~+w9KP*!8<;*A3dcT}<`(@$?0wVt0#7c7wg~p%CWYh7n0)nhBB02copj zl>Z@=D|jdIGR^nly#?=+c-eOcULFBFF8mPz8DvSeu|9%+T=1M+zq@uGL|Z?uox}JZ z!lxJI5nN@5tcdSnTt^2WcL<+7w|^seBJ*7B&$q%b==wDN>$3!z*-ask|Y@2ol?*L+fw}2tcHsD^`!5Ztd;?79xBz7G$Rn@hRpr2AhZq%5Q-;c=ldV4W5 z=i!~i=kRmTM87oL&2!Q1;MPggi;>It)VDbIu43fIlaDRDCALnh2KEByY+bekM z&tV+1L~HKth-}y1i7i<}}J>lrMm89lvvEWxwa)?+5h!);Fj1dKg*X`u?+v)4Om4 zBZW_WIlaQapXB5A8A+OFL56~uBb_DYlox~VQ!+5#(MxkZc zY2zH!#8p$*Fl5K@QtOnng*2Z!ezo?%F0#znFOS^#K0Sr=fjiCb&W*Jj@g!%&!+($K z5djep0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo z0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p z5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo z0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p x5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVo0TB=Z5fA|p5CIVof&VuG{{`sz4+~OFnwUbjbW6J>wB;d* zX%KvXf|?i;(Zt{fAu$*}Xb>SLCM14PG=?Y|Lo|L7KN!&vNr+kh=gytBl$St>f&6E? z-JO{;_ul#4GiP?Ux~;h;-IkJpOVn=Y!K*6~kwRx+$StpbQMYy3EjPjjC_n)UP=Epy zpa2CZKmiI+fC3b_u0VBLb7f0ry@cQHJ$uB!^&V`G6^Wc4B2qo}neEqY_&NdF{*1R@ zs^}j!$`^^pME=5$55I;3u>mu&{bBqJaih!0>m2hU`qX8V{lVjJ8~?uDuKV_3Tl0YN zJc9KLuI?2XKA?~G@W&JEJ80i8MQjb)JUXBq)4)yq`z7Zl4!Xi2Q>KWtN!~S-YYm0japD7JMdOdP?w|mQK^w=66k;0jei~lW*s@VN zu+|~Xh@6J?4s0)#&DfX0>r9!B$1J>?E*1En>g~Ssk~P=KW=~j{k(shsi@d zSt#A+NbD+*g2;l1EJfJUHsX9^PCu;0QiXjJ@$@z2w3*32#N{zG(Fn3MPCspipma%3 zd^Z^p-*fV0EH;FhJ}fs!R@<;Nq%zp&CiBGeaLpBCB~0Vv)zsK4Jbo@N z3(#U02CmuCg)P3A~}uSG$pz5GOxXxBkYdQMk4D52?+&9!c9(EKliTPSub!vCci9xu<+J*qhT!}@TLX%EfjCFYy zDO!ohMkG?kj9VwIP#n+6X6GY7tC~*SyiCkMwIdaDaKW|WMxA^NVKa``3tOK-TTR%a z){mlzun501Er#jTY3atu0z#3|i15RD++6F+<7iM@x962FLn21p2cbwk^F*fN zm+RmxVlq@>g4-7s5AXCDleme);b!}EtQAUuEW+!{krKot@UTlySQlT&7deJTFYXHV zxVRW}iE7tNG3HB))l{j+whU&u0|uQk)uwAZ)-&={#fJJRpZ!$%X{~=gz4zkxH+p=j zx$cxgua6)rwNeDdd)QmKhx9g~1zg{MyYR~uhgRk~ z1PhCIm1(vS+qEvv!K>bdHP3c+c&Js{sqVcWPhaa{)QKUtyD@@PZ%uSz=;%aGw#Sd? zi|*gqDqJobaGaaKs5Jfo8-HJ4d=93*3&P=L?k3zIcB+jvsS=DNZ@@(m7GgIMk%Fs^ zCn)xP7fut#gJjY865EGni#^*YQc!PH>&&>L!B|RdoW|R@d{aUi9Jkzuq76nzjhHhgw`i4TxSYH8873 zZLC8=HefD0Fgm@u^bXjGEtg*_+GGD~Z47!}Wm@a&S1YgH?zQZvu&)Y7bmGj{n4Hx* zpD}mYb=XsnQPkmej7-AWZ^5(wV}?w|kyoy34T#ozVH&j#*{`3k^mEqdxDfGYmeIS9 zU*U7sVAZd^&cON=_7~Q#f9{<6b*)T(Zjds$0y!RL@+UTv?;UpMX7Wmtxr3F#_WOY5 zujcV-yrSBh<%0_+Zet$5ds!Zb{e^j)y*u*w%|XfI*{I0ny?K1h=JBGjwNmnmznW;R|9`79vRLz3^ZIMN;)ASN5+!9HU;aIKuho*2oY%AP`JfD+MrNA4{tcfrj@!I`aNOOI*MnQDkv5vgTqr;R3Q&Lo6rcbF zC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epy zpa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+ zfC3bt00k&O0SZun0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O z0SZun0u-PC1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC z1t>rP3Q&Lo6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo z6rcbFC_n)UP=Epypa2CZKmiI+fC3bt00k&O0SZun0u-PC1t>rP3Q&Lo6rcbFC~!Lj F{sr>q;R^r& literal 0 HcmV?d00001 diff --git a/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.json b/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.json new file mode 100644 index 000000000..428bd6b1e --- /dev/null +++ b/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.json @@ -0,0 +1,208 @@ +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 13, + "Version": 2, + "Level": 4, + "Task": 13, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:55:53.550235Z" + } + }, + "EventRecordID": 35579, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "EventType": "SetValue", + "UtcTime": "2026-03-11 05:55:53.547", + "ProcessGuid": "0197231E-03E9-69B1-BA1A-000000000800", + "ProcessId": 9860, + "Image": "C:\\WINDOWS\\system32\\reg.exe", + "TargetObject": "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig", + "Details": "DWORD (0x00000001)", + "User": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 13, + "Version": 2, + "Level": 4, + "Task": 13, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:55:53.593526Z" + } + }, + "EventRecordID": 35581, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "EventType": "SetValue", + "UtcTime": "2026-03-11 05:55:53.581", + "ProcessGuid": "0197231E-03E9-69B1-BB1A-000000000800", + "ProcessId": 6164, + "Image": "C:\\WINDOWS\\system32\\reg.exe", + "TargetObject": "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR", + "Details": "DWORD (0x00000001)", + "User": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 13, + "Version": 2, + "Level": 4, + "Task": 13, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:55:53.648759Z" + } + }, + "EventRecordID": 35583, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "EventType": "SetValue", + "UtcTime": "2026-03-11 05:55:53.645", + "ProcessGuid": "0197231E-03E9-69B1-BC1A-000000000800", + "ProcessId": 8776, + "Image": "C:\\WINDOWS\\system32\\reg.exe", + "TargetObject": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig", + "Details": "DWORD (0x00000001)", + "User": "swachchhanda\\xodih" + } + } +} +{ + "Event": { + "#attributes": { + "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event" + }, + "System": { + "Provider": { + "#attributes": { + "Name": "Microsoft-Windows-Sysmon", + "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9" + } + }, + "EventID": 13, + "Version": 2, + "Level": 4, + "Task": 13, + "Opcode": 0, + "Keywords": "0x8000000000000000", + "TimeCreated": { + "#attributes": { + "SystemTime": "2026-03-11T05:55:54.364135Z" + } + }, + "EventRecordID": 35585, + "Correlation": null, + "Execution": { + "#attributes": { + "ProcessID": 3208, + "ThreadID": 1724 + } + }, + "Channel": "Microsoft-Windows-Sysmon/Operational", + "Computer": "swachchhanda", + "Security": { + "#attributes": { + "UserID": "S-1-5-18" + } + } + }, + "EventData": { + "RuleName": "-", + "EventType": "SetValue", + "UtcTime": "2026-03-11 05:55:54.362", + "ProcessGuid": "0197231E-03EA-69B1-BD1A-000000000800", + "ProcessId": 9004, + "Image": "C:\\WINDOWS\\system32\\reg.exe", + "TargetObject": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR", + "Details": "DWORD (0x00000001)", + "User": "swachchhanda\\xodih" + } + } +} diff --git a/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml b/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml new file mode 100644 index 000000000..86feb5f6c --- /dev/null +++ b/regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml @@ -0,0 +1,13 @@ +id: 70b0db86-1b38-48dd-8ddb-29357e0c0149 +description: N/A +date: 2026-03-11 +author: Swachchhanda Shrawan Poudel (Nextron Systems) +rule_metadata: + - id: 5de03871-5d46-4539-a82d-3aa992a69a83 + title: Registry Disable System Restore +regression_tests_info: + - name: Positive Detection Test + type: evtx + provider: Microsoft-Windows-Sysmon + match_count: 4 + path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/5de03871-5d46-4539-a82d-3aa992a69a83.evtx diff --git a/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml b/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml index 852c3c356..f4cbd969e 100644 --- a/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml +++ b/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml @@ -38,11 +38,17 @@ detection: - '\Windows\WindowsUpdate\' - '\Windows\UpdateOrchestrator\Schedule' - '\Windows\ExploitGuard' - filter_sys_username: + filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: '$' # False positives during upgrades of Defender, where its tasks get removed and added TaskName|contains: '\Windows\Windows Defender\' - condition: selection and not 1 of filter_* + condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high +regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml +simulation: + - type: atomic-red-team + name: Windows - Disable the SR scheduled task + technique: T1490 + atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034 diff --git a/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml b/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml similarity index 61% rename from rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml rename to rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml index 013f25157..3741012fb 100644 --- a/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml +++ b/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml @@ -1,18 +1,20 @@ -title: Important Scheduled Task Deleted +title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 # ProcCreation schtasks delete type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog type: similar + - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 # ProcCreation schtasks disable + type: similar status: test description: | - Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities + Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 -modified: 2023-02-07 +modified: 2026-03-11 tags: - attack.impact - attack.t1489 @@ -22,7 +24,9 @@ logsource: definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: - EventID: 141 + EventID: + - 141 # Task Deleted + - 142 # Task Disabled TaskName|contains: - '\Windows\SystemRestore\SR' - '\Windows\Windows Defender\' @@ -31,11 +35,17 @@ detection: - '\Windows\WindowsUpdate\' - '\Windows\UpdateOrchestrator\' - '\Windows\ExploitGuard' - filter: + filter_main_user: UserName|contains: - 'AUTHORI' - 'AUTORI' - condition: selection and not filter + condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high +regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml +simulation: + - type: atomic-red-team + name: Windows - Disable the SR scheduled task + technique: T1490 + atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034 diff --git a/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml b/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml new file mode 100644 index 000000000..6f66c5df4 --- /dev/null +++ b/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml @@ -0,0 +1,51 @@ +title: System Restore Registry Modification via CommandLine +id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 +related: + - id: 5de03871-5d46-4539-a82d-3aa992a69a83 + type: similar +status: experimental +description: | + Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry +author: Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2026-03-11 +tags: + - attack.impact + - attack.t1490 +logsource: + category: process_creation + product: windows +detection: + selection_img: + - Image|endswith: + - '\powershell.exe' + - '\pwsh.exe' + - '\reg.exe' + - OriginalFileName: + - 'powershell.exe' + - 'pwsh.dll' + - 'reg.exe' + selection_cli_action: + CommandLine|contains: + - ' add ' + - 'Set-ItemProperty' + - 'New-ItemProperty' + selection_cli_reg_root: + CommandLine|contains: + - '\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore' + - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore' + selection_cli_reg_key: + CommandLine|contains: + - 'DisableConfig' + - 'DisableSR' + condition: all of selection_* +falsepositives: + - Unknown +level: high +regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml +simulation: + - type: atomic-red-team + name: Disable System Restore Through Registry + technique: T1490 + atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f diff --git a/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml b/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml index a559cb449..799e0262c 100644 --- a/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml +++ b/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml @@ -11,6 +11,7 @@ references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 +modified: 2026-03-11 tags: - attack.impact - attack.t1489 @@ -18,11 +19,12 @@ logsource: category: process_creation product: windows detection: - selection: - Image|endswith: '\schtasks.exe' - CommandLine|contains|all: - - '/delete' - - '/tn' + selection_img: + - Image|endswith: '\schtasks.exe' + - OriginalFileName: 'schtasks.exe' + selection_cli_delete: + CommandLine|contains|windash: '/delete' + selection_cli_task: CommandLine|contains: # Add more important tasks - '\Windows\BitLocker' @@ -32,7 +34,8 @@ detection: - '\Windows\Windows Defender\' - '\Windows\WindowsBackup\' - '\Windows\WindowsUpdate\' - condition: selection + condition: all of selection_* falsepositives: - Unlikely level: high +regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml diff --git a/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml b/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml index a3ce9380f..6cd17b509 100644 --- a/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml +++ b/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml @@ -3,6 +3,8 @@ id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 related: - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog type: similar + - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog + type: similar status: test description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities references: @@ -11,7 +13,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior date: 2021-12-26 -modified: 2024-08-25 +modified: 2026-03-11 tags: - attack.impact - attack.t1489 @@ -19,12 +21,12 @@ logsource: category: process_creation product: windows detection: - selection: - Image|endswith: '\schtasks.exe' - CommandLine|contains|all: - - '/Change' - - '/TN' - - '/disable' + selection_img: + - Image|endswith: '\schtasks.exe' + - OriginalFileName: 'schtasks.exe' + selection_cli_disable: + CommandLine|contains|windash: '/disable' + selection_cli_task: CommandLine|contains: # Add more important tasks - '\Windows\BitLocker' @@ -35,7 +37,13 @@ detection: - '\Windows\Windows Defender\' - '\Windows\WindowsBackup\' - '\Windows\WindowsUpdate\' - condition: selection + condition: all of selection_* falsepositives: - Unknown level: high +regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml +simulation: + - type: atomic-red-team + name: Windows - Disable the SR scheduled task + technique: T1490 + atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034 diff --git a/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml b/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml index a59931d4d..fec5b0fb3 100644 --- a/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml +++ b/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml @@ -1,5 +1,8 @@ title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 +related: + - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 + type: similar status: test description: Detects the modification of the registry to disable a system restore on the computer references: @@ -26,3 +29,9 @@ detection: falsepositives: - Unknown level: high +regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml +simulation: + - type: atomic-red-team + name: Disable System Restore Through Registry + technique: T1490 + atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f