mdecrevoisier high experimental sigma

Backdoor introduction via registry permission change through WMI (DAMP)

Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4674,
    "ProcessName
| endswith": "\\System32\\wbem\\WmiPrvSE.exe",
    "ObjectServer": "Security",
    "ObjectType": "Key",
    "ObjectName
| startswith": [
      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurePipeServers\\winreg",
      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Data",
      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\GBG",
      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\JD",
      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Skew1",
      "\\REGISTRY\\MACHINE\\SECURITY\\Policy\\Accounts",
      "\\REGISTRY\\MACHINE\\SECURITY\\Policy\\Pol",
      "\\REGISTRY\\MACHINE\\SECURITY\\Policy\\Secrets",
      "\\REGISTRY\\MACHINE\\SECURITY\\Policy\\PolEKList",
      "\\REGISTRY\\MACHINE\\SECURITY\\Cache",
      "\\REGISTRY\\MACHINE\\SAM\\SAM\\DOMAINS\\Account",
      "\\REGISTRY\\MACHINE\\SAM\\SAM\\DOMAINS\\Builtin"
    ]
  },
  "filter": {
    "SubjectUserName
| endswith": "$"
  },
  "condition": "selection and not filter
| count(ObjectName) by Computer > 10",
  "timeframe": "5m"
}

False Positives

⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...