Closed Ptylu closed 2 years ago
Hello, could you please tell me if the format is good. I chose to submit this detection because it was not very complex. I have other detections much more complex than this one that I would like to share if this one is valid.
Hi @luffy68 - this looks good! A few suggestions:
Hi @ikiril01 , thanks, I will do that today !
Creation of SafeDllSearchMode
Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode. The key SafeDllSearchMode, if set to 0, will block the Windows mechanism for the search DLL order.
ATT&CK Coverage
Analytic Code
(("reg "AND "add" AND "/d") OR ("Set-ItemProperty" AND "-value")) AND ("Session Manager" AND "SafeDllSearchMode")
Test Cases
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /d 0
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Session Manager" -Name SafeDllSearchMode -Value 0
Data Model Mappings
Developer Certificate of Origin
DCO signed-off-by: Lucas Heiligenstein lucas.heiligenstein@gmail.com