Detectionhightest

Potential Attachment Manager Settings Associations Tamper

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Mon Aug 01Updated Thu Aug 17a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection_main:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\'
    selection_value_default_file_type_rsik:
        TargetObject|endswith: '\DefaultFileTypeRisk'
        Details: 'DWORD (0x00006152)'
    selection_value_low_risk_filetypes:
        TargetObject|endswith: '\LowRiskFileTypes'
        Details|contains: # Add more as you see fit
            - '.zip;'
            - '.rar;'
            - '.exe;'
            - '.bat;'
            - '.com;'
            - '.cmd;'
            - '.reg;'
            - '.msi;'
            - '.htm;'
            - '.html;'
    condition: selection_main and 1 of selection_value_*