Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
X__Junior (Nextron Systems)Created Fri Nov 034d431012-2ab5-4db7-a84e-b29809da2172windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetObject|contains: '\Microsoft\WBEM\CIMOM\AllowAnonymousCallback'
        Details: 'DWORD (0x00000001)'
    condition: selection
False Positives

Administrative activity

References
1
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Rule Metadata
Rule ID
4d431012-2ab5-4db7-a84e-b29809da2172
Status
test
Level
medium
Type
Detection
Created
Fri Nov 03
Author
X__Junior (Nextron Systems)
Path
rules/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml
Raw Tags
attack.defense-evasionattack.t1562.001
View on GitHub