Detectionmediumtest
ClickOnce Trust Prompt Tampering
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
@serkinvalery, Nasreddine Bencherchali (Nextron Systems)Created Mon Jun 12Updated Thu Aug 17ac9159cc-c364-4304-8f0a-d63fc1a0aabbwindows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|contains: '\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\'
TargetObject|endswith:
- '\Internet'
- '\LocalIntranet'
- '\MyComputer'
- '\TrustedSites'
- '\UntrustedSites'
Details: 'Enabled'
condition: selectionFalse Positives
Legitimate internal requirements.
MITRE ATT&CK
Techniques
Rule Metadata
Rule ID
ac9159cc-c364-4304-8f0a-d63fc1a0aabb
Status
test
Level
medium
Type
Detection
Created
Mon Jun 12
Modified
Thu Aug 17
Path
rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml
Raw Tags
attack.persistenceattack.defense-evasionattack.t1112