Detection rules › Sigma
Register New IFiltre For Persistence
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: 1 of selection_ext
TargetObject|contains: '\PersistentHandler'
TargetObject|contains: '\SOFTWARE\Classes\.'
Stage 2: 1 of selection_clsid
TargetObject|contains: '\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}'
TargetObject|contains: '\SOFTWARE\Classes\CLSID'
Stage 3: not 1 of filter_*
or:
Image|startswith: 'C:\Program Files (x86)\'
Image|startswith: 'C:\Program Files\'
Image|startswith: 'C:\Windows\System32\'
TargetObject|contains: '\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\'
TargetObject|contains: '\CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\'
TargetObject|contains: '\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\'
TargetObject|contains: '\CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\'
TargetObject|contains: '\CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\'
TargetObject|contains: '\CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\'
TargetObject|contains: '\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\'
TargetObject|contains: '\CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\'
TargetObject|contains: '\CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\'
TargetObject|contains: '\CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\'
TargetObject|contains: '\CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\'
TargetObject|contains: '\CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\'
TargetObject|contains: '\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\'
TargetObject|contains: '\CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\'
TargetObject|contains: '\CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\'
TargetObject|contains: '\CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\'
TargetObject|contains: '\CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\'
TargetObject|contains: '\CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\'
TargetObject|contains: '\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\'
TargetObject|contains: '\CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\'
TargetObject|contains: '\CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\'
TargetObject|contains: '\CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\'
TargetObject|contains: '\CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\'
TargetObject|contains: '\CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\'
TargetObject|contains: '\CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\'
TargetObject|contains: '\CLSID\{FB10BD80-A331-4e9e-9EB7-00279903AD99}\'
TargetObject|contains: '\CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\'
TargetObject|contains: '\CLSID\{eec97550-47a9-11cf-b952-00aa0051fe20}'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | starts_with |
|
TargetObject | match |
|