win:etw
ETW providers (not persisted to a log by default)
Provider named in the event key
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 29
- Rules listed
- 15
- Events
- 1
Techniques
- T1027.007 Dynamic API Resolution
- T1036.012 Browser Fingerprint
- T1055 Process Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.015 ListPlanting
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1102.003 One-Way Communication
- T1124 System Time Discovery
- T1134 Access Token Manipulation
- T1134.001 Token Impersonation/Theft
- T1134.002 Create Process with Token
- T1134.004 Parent PID Spoofing
- T1134.005 SID-History Injection
- T1135 Network Share Discovery
- T1189 Drive-by Compromise
- T1495 Firmware Corruption
- T1499.001 OS Exhaustion Flood
- T1564.004 NTFS File Attributes
- T1564.005 Hidden File System
- T1574.013 KernelCallbackTable
- T1614 System Location Discovery
- T1614.001 System Language Discovery
- T1620 Reflective Code Loading
- T1622 Debugger Evasion
Rules
Sigma 15
- Access To .Reg/.Hive Files By Uncommon Applications by frack113
- Access To Browser Credential Files By Uncommon Applications by frack113, X__Junior (Nextron Systems)
- Access To Chromium Browsers Sensitive Files By Uncommon Applications by X__Junior (Nextron Systems)
- Access To Crypto Currency Wallets By Uncommon Applications by X__Junior (Nextron Systems)
- Access To Potentially Sensitive Sysvol Files By Uncommon Applications by frack113
- Access To Sysvol Policies Share By Uncommon Process by frack113
- Access To Windows Credential History File By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Access To Windows DPAPI Master Keys By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Access To Windows Outlook Mail Files By Uncommon Applications by frack113
- Credential Manager Access By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Teams Sensitive File Access By Uncommon Applications by @SerkinValery
- Non-DLL Extension File Renamed With DLL Extension by frack113
- Suspicious Appended Extension by frack113
- Suspicious File Access to Browser Credential Storage by frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
- Unattend.XML File Access Attempt by frack113