Add more keys concerned with lsa ppl protection #5399
Conversation
github-actions
bot
added
Rules
Windows
| - 'd ' | ||
| - 'v ' |
There was a problem hiding this comment.
because "-" can be also used instead of /
There was a problem hiding this comment.
that's what the |windash modifier is for. --> please add them back and use |windash
nasbench
added
2nd Review Needed
rules/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml
Outdated
Show resolved
Hide resolved
| - 'd ' | ||
| - 'v ' |
There was a problem hiding this comment.
that's what the |windash modifier is for. --> please add them back and use |windash
| filter: | ||
| CommandLine|contains: | ||
| - "01" | ||
| - "02" |
There was a problem hiding this comment.
What is filtered here? Can you give an example? (Is it a main or optional filter?)
There was a problem hiding this comment.
When modifying the registry using the reg command, you can pass a value using either of the following formats:
/d 0 /d 00000000
For example:
The intention of rule is to catch this commandline
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "0"
But, This means the rule will be triggered if the value is set like this:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "00000001"
or similarly with other non-zero DWORD values like "00000002".
Co-authored-by: phantinuss <[email protected]>
Summary of the Pull Request
Add more keys concerned with lsa ppl protection
Changelog
update: LSA PPL Protection Disabled Via Reg.EXE - Add more keys regarding LSA PPL
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions