Event Triggered Execution via Remote Registry Modification
This rule detects attempts to modify the Windows Registry remotely, specifically targeting the 'HKLM' hive and paths containing 'shell\open\command'. This pattern is often used by adversaries to establish persistence or achieve privilege escalation by modifying how applications or the system execute commands, for example, by hijacking file associations or application startup commands. The detection is based on network traffic over TCP port 445, which is commonly used for SMB/CIFS, indicating a remote registry operation.
Suricata
