Potential Attachment Manager Settings Tampering
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry keys. Adversaries might do this to lower the default file type risk, allowing potentially malicious files (like executables, scripts, or archives) to bypass security warnings when downloaded or opened. The rule specifically looks for modifications to 'DefaultFileTypeRisk' to a value that indicates low risk (0x00006152) or additions of common executable/script file extensions to 'LowRiskFileTypes'.
Sigma
