KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder

Description

'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'

Query · kql

// COM hi-jack via registry
let guids = dynamic(["{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}","{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}","{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{4de225bf-cf59-4cfc-85f7-68b90f185355}", "{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}"]); 
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID"
| where RegistryKey has_any (guids)
| where RegistryValueData has "System32\\spool\\drivers\\color"
Raw source KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9c1331df-9bb3-4b52-b7d7-5a6e9e6d97b4
name: KNOTWEED-COM Registry Key Modified to Point to Color Profile Folder
description: |
  'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceRegistryEvents
tactics:
relevantTechniques:
query: |
  // COM hi-jack via registry
  let guids = dynamic(["{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}","{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}","{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{4de225bf-cf59-4cfc-85f7-68b90f185355}", "{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}"]); 
  DeviceRegistryEvents
  | where ActionType == "RegistryValueSet"
  | where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID"
  | where RegistryKey has_any (guids)
  | where RegistryValueData has "System32\\spool\\drivers\\color"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.