Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
21
21
9
8
5
Contributors
30
9
6
4
4
Categories
43
26
25
20
18
Platforms
72
1
Products / Services
24
15
14
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
The analytic identifies the creation or modification of Image File Execution Options (IFEO) registry keys, detected via EventCode 3000 in the Application channel. This detection leverages Windows Event Logs to monitor for process names added to IFEO under specific registry paths. This activity is significant as it can indicate attempts to set traps for process monitoring or debugging, often used by attackers for persistence or evasion. If confirmed malicious, this could allow an attacker to execute arbitrary code or manipulate process behavior, leading to potential system compromise.
The following analytic detects modifications to registry keys under "Image File Execution Options" that can be used for privilege escalation. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths and values like GlobalFlag and Debugger. This activity is significant because attackers can use these modifications to intercept executable calls and attach malicious binaries to legitimate system binaries. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges, leading to potential system compromise and persistent access.
Detects the registration of a debugger for a program that is available in the logon screen, commonly known as a sticky key backdoor. This technique involves modifying the Image File Execution Options (IFEO) registry key to launch an arbitrary executable (debugger) when a legitimate accessibility program (like sethc.exe or utilman.exe) is invoked from the logon screen. This can be used for persistence and privilege escalation to gain SYSTEM privileges.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
Detects when an attacker modifies the 'Debugger' value within the 'AeDebug' registry key to establish persistence. This mechanism ensures that a specified malicious executable or DLL is launched whenever an application crashes, providing a persistent foothold on the system.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Page 4 of 4