LoFP LoFP / administrator may access this registry for product key recovery purposes.

Techniques

Sample rules

Windows Hosts File Access

Description

This Analytic detects the execution of a process attempting to access the hosts file. The hosts file is a critical file for network configuration and DNS resolution. If an attacker gains access to it, they can redirect traffic to malicious websites, serve fake content or block legitimate security websites.

Detection logic

`wineventlog_security`
EventCode=4663
object_file_path="*:\\Windows\\System32\\drivers\\etc\\hosts"
NOT process_path IN (
    "*:\\Windows\\explorer.exe",
    "*:\\Windows\\System32\\lsass.exe",
    "*:\\Windows\\System32\\SearchIndexer.exe",
    "*:\\Windows\\System32\\services.exe",
    "*:\\Windows\\System32\\svchost.exe",
    "*:\\Windows\\SysWow64\\SearchIndexer.exe",
    "*:\\Windows\\SysWow64\\svchost.exe"
)

| stats count
    by _time object_file_path object_file_name dest process_name
       process_path process_id EventCode

| eval process_path = lower(process_path)

| lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path

| eval is_valid_browser_path=coalesce(is_valid_browser_path,"false")

| where is_valid_browser_path = "false"

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_hosts_file_access_filter`

Windows Product Key Registry Query

Description

This Analytic detects the execution of a process attempting to access the registry for product key recovery purposes. This behavior could be significant as it might indicate potential malware activity or attempts to bypass security measures or data exfiltration.

Detection logic

`wineventlog_security`
EventCode=4663
object_file_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"

| stats count min(_time) as firstTime max(_time) as lastTime
    by object_file_name object_file_path process_name
       process_path process_id EventCode dest

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_product_key_registry_query_filter`