Detection rules › Sigma
Potential Attachment Manager Settings Associations Tamper
Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: selection_main
TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\'
Stage 2: 1 of selection_value_default_file_type_rsik
Details: 'DWORD (0x00006152)'
TargetObject|endswith: '\DefaultFileTypeRisk'
Stage 3: 1 of selection_value_low_risk_filetypes
or:
Details|contains: '.bat;'
Details|contains: '.cmd;'
Details|contains: '.com;'
Details|contains: '.exe;'
Details|contains: '.htm;'
Details|contains: '.html;'
Details|contains: '.msi;'
Details|contains: '.rar;'
Details|contains: '.reg;'
Details|contains: '.zip;'
TargetObject|endswith: '\LowRiskFileTypes'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Details | eq |
|
Details | match |
|
TargetObject | ends_with |
|
TargetObject | match |
|