Hayabusa high test sigma

Suspicious Path In Keyboard Layout IME File Registry Value

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

View Source

Detection Logic

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection_registry": {
    "ObjectName
| contains
| all": [
      "\\Control\\Keyboard Layouts\\",
      "Ime File"
    ]
  },
  "selection_folders_1": {
    "NewValue
| contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Temporary Internet"
    ]
  },
  "selection_folders_2": [
    {
      "NewValue
| contains
| all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "NewValue
| contains
| all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "NewValue
| contains
| all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    }
  ],
  "condition": "registry_set and (selection_registry and 1 of selection_folders_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...