Detectionhightest

Suspicious Run Key from Download

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)Created Tue Oct 01Updated Mon Feb 179c5037d1-c568-49b3-88c7-9846a5bdc2bewindows

Log Source

WindowsRegistry Event

ProductWindows← raw: windows

CategoryRegistry Event← raw: registry_event

Events for Windows Registry modifications including key creation, modification, and deletion.

Detection Logic

detection:
    selection:
        Image|contains:
            - '\AppData\Local\Packages\Microsoft.Outlook_'
            - '\AppData\Local\Microsoft\Olk\Attachments\'
            - '\Downloads\'
            - '\Temporary Internet Files\Content.Outlook\'
            - '\Local Settings\Temporary Internet Files\'
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
    condition: selection