Detectionhightest
Narrator's Feedback-Hub Persistence
Detects abusing Windows 10 Narrator's Feedback-Hub
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Dmitriy Lifanov, oscd.communityCreated Fri Oct 25Updated Sat Mar 26f663a6d9-9d1b-49b8-b2b1-0637914d199awindows
Log Source
WindowsRegistry Event
ProductWindows← raw: windows
CategoryRegistry Event← raw: registry_event
Events for Windows Registry modifications including key creation, modification, and deletion.
Detection Logic
Detection Logic2 selectors
detection:
selection1:
EventType: DeleteValue
TargetObject|endswith: '\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute'
selection2:
TargetObject|endswith: '\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default)'
# Add the payload in the (Default)
condition: 1 of selection*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Rule Metadata
Rule ID
f663a6d9-9d1b-49b8-b2b1-0637914d199a
Status
test
Level
high
Type
Detection
Created
Fri Oct 25
Modified
Sat Mar 26
Author
Path
rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.t1547.001