Detectionmediumtest

Add Port Monitor Persistence in Registry

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Thu Dec 30Updated Mon Mar 25944e8941-f6f6-4ee8-ac05-1c224e923c0ewindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\Control\Print\Monitors\'
        Details|endswith: '.dll'
    filter_optional_cutepdf:
        Image: 'C:\Windows\System32\spoolsv.exe'
        TargetObject|contains: '\Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver'
        Details: 'cpwmon64_v40.dll'
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    filter_optional_monvnc:
        TargetObject|contains: '\Control\Print\Monitors\MONVNC\Driver'
    filter_optional_vnc:
        TargetObject|contains|all:
            - 'Control\Print\Environments\'
            - '\Drivers\'
            - '\VNC Printer'
    condition: selection and not 1 of filter_optional_*