Nasreddine Bencherchali
8cbcaea48a
fix: New TimeProviders Registered With Uncommon DLL Name - Add new legitimate entry to avoid FPs new: Service Binary in User Controlled Folder remove: Adwind RAT / JRAT - Registry remove: Service Binary in Uncommon Folder update: Add Port Monitor Persistence in Registry - Update logic to avoid hardcoded HKLM values update: Change Winevt Channel Access Permission Via Registry - Update logic to avoid hardcoded HKLM values update: CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry - Add more entries to increase coverage and update metadata information update: Default RDP Port Changed to Non Standard Port - Update logic to avoid hardcoded HKLM values update: Disable Administrative Share Creation at Startup - Update logic to avoid hardcoded HKLM values update: Disable Microsoft Defender Firewall via Registry - Update logic to avoid hardcoded HKLM values update: Disable Windows Event Logging Via Registry - Update logic to avoid hardcoded HKLM values update: Displaying Hidden Files Feature Disabled - Update logic to avoid hardcoded HKLM values update: FlowCloud Registry Marker - Update logic to avoid hardcoded HKLM values update: New PortProxy Registry Entry Added - Update logic to avoid hardcoded HKLM values update: Potential CobaltStrike Service Installations - Registry - Update logic to avoid hardcoded HKLM values update: Register New IFiltre For Persistence - Update logic to avoid hardcoded HKLM values update: Registry Persistence via Service in Safe Mode - Update logic to avoid hardcoded HKLM values update: Run Once Task Configuration in Registry - Update logic to avoid hardcoded HKLM values update: Security Support Provider (SSP) Added to LSA Configuration - Update logic to avoid hardcoded HKLM values update: ServiceDll Hijack - Update logic to avoid hardcoded HKLM values update: Sysmon Driver Altitude Change - Update logic to avoid hardcoded HKLM values update: Windows Defender Service Disabled - Registry - Update logic to avoid hardcoded HKLM values --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
title: Service Binary in Uncommon Folder
|
|
id: 277dc340-0540-42e7-8efb-5ff460045e07
|
|
status: deprecated
|
|
description: Detect the creation of a service with a service binary located in a uncommon directory
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
|
|
author: Florian Roth (Nextron Systems)
|
|
date: 2022/05/02
|
|
modified: 2024/03/25
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1112
|
|
logsource:
|
|
category: registry_set
|
|
product: windows
|
|
detection:
|
|
selection_1:
|
|
TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\'
|
|
TargetObject|endswith: '\Start'
|
|
Image|contains:
|
|
- '\AppData\Local\'
|
|
- '\AppData\Roaming\'
|
|
Details:
|
|
- 'DWORD (0x00000000)' # boot
|
|
- 'DWORD (0x00000001)' # System
|
|
- 'DWORD (0x00000002)' # Automatic
|
|
# 3 - Manual , 4 - Disabled
|
|
selection_2:
|
|
TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\'
|
|
TargetObject|endswith: '\ImagePath'
|
|
Details|contains:
|
|
- '\AppData\Local\'
|
|
- '\AppData\Roaming\'
|
|
filter:
|
|
- Image|contains:
|
|
- '\AppData\Roaming\Zoom'
|
|
- '\AppData\Local\Zoom'
|
|
- Details|contains:
|
|
- '\AppData\Roaming\Zoom'
|
|
- '\AppData\Local\Zoom'
|
|
condition: 1 of selection_* and not filter
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|