Techniques
Sample rules
Powershell Timestomp
- source: sigma
- technicques:
- t1070
- t1070.006
Description
Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Detection logic
condition: selection_ioc
selection_ioc:
ScriptBlockText|contains:
- .CreationTime =
- .LastWriteTime =
- .LastAccessTime =
- '[IO.File]::SetCreationTime'
- '[IO.File]::SetLastAccessTime'
- '[IO.File]::SetLastWriteTime'
Registry Hide Function from User
- source: sigma
- technicques:
- t1112
Description
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detection logic
condition: 1 of selection_set_*
selection_set_0:
Details: DWORD (0x00000000)
TargetObject|endswith:
- SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
- SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
selection_set_1:
Details: DWORD (0x00000001)
TargetObject|endswith:
- SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock
- SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth
- SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork
- SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAPower
- SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume
Disable Privacy Settings Experience in Registry
- source: sigma
- technicques:
- t1685
Description
Detects registry modifications that disable Privacy Settings Experience
Detection logic
condition: selection
selection:
Details: DWORD (0x00000000)
TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience