Service Registry ACL Weakness Exploited Remotely
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
Suricata
