security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update persistence_services_registry.toml (#4989)

Browse Source
This commit is contained in:
Samirbous
2025-08-18 14:05:25 +01:00
committed by GitHub
parent b7de4f5126
commit 36b33e2c13
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_services_registry.toml
+10 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/18"
[rule]
author = ["Elastic"]
@@ -92,7 +92,13 @@ registry where host.os.type == "windows" and event.type == "change" and
"\\SystemRoot\\System32\\drivers\\*.sys",
"\\??\\?:\\Windows\\system32\\Drivers\\*.SYS",
"\\??\\?:\\Windows\\syswow64\\*.sys",
"system32\\DRIVERS\\USBSTOR") and
"system32\\DRIVERS\\USBSTOR",
"system32\\drivers\\*.sys",
"C:\\WindowsAzure\\GuestAgent*.exe",
"\"C:\\Program Files\\Common Files\\McAfee\\*",
"C:\\Program Files (x86)\\VERITAS\\VxPBX\\bin\\pbx_exchange.exe",
"\"C:\\Program Files (x86)\\VERITAS\\VxPBX\\bin\\pbx_exchange.exe\"",
"\"C:\\ProgramData\\McAfee\\Agent\\Current\\*") and
not (process.name : "procexp??.exe" and registry.data.strings : "?:\\*\\procexp*.sys") and
not process.executable : (
"?:\\Program Files\\*.exe",
@@ -103,7 +109,8 @@ registry where host.os.type == "windows" and event.type == "change" and
"?:\\Windows\\System32\\services.exe",
"?:\\Windows\\System32\\msiexec.exe",
"?:\\Windows\\System32\\regsvr32.exe",
"?:\\Windows\\System32\\WaaSMedicAgent.exe"
"?:\\Windows\\System32\\WaaSMedicAgent.exe",
"?:\\Windows\\UUS\\amd64\\WaaSMedicAgent.exe"
)
'''