Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identify potential new registry key name that is a non-autorun and non-run key in the HKLM\Software\Microsoft\Windows\CurrentVersion\ registry key containing VBScript in the key value value.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Cyborg Security HUNTER |
| ID | d7233f14-4705-403e-9db9-e0d677c9506b |
| Tactics | DefenseEvasion |
| Techniques | T1112 |
| Required Connectors | SecurityEvent |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
NewValue contains "CreateObject"NewValue contains "Execute("NewValue contains "RegRead"NewValue contains "RunHTMLApplication"NewValue contains "jscript"NewValue contains "mshtml"NewValue contains "mshtml,"NewValue contains "vbscript"NewValue contains "window.close"ObjectName !has "\\Run"ObjectName has "\\CurrentVersion" |
✓ | ✓ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊