Register New IFilter For Persistence
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. Attackers can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files, which can be abused for persistence. The rule specifically looks for modifications to registry keys related to PersistentHandler and CLSID, while filtering out known legitimate system paths and default IFilter CLSIDs to reduce false positives.
Sigma
