Small Sieve Malware Registry Persistence

title: Small Sieve Malware Registry Persistence
id: 65c6e3c1-fb28-4c03-a51e-84919d8185f1
status: test
description: Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-19
modified: 2023-08-17
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection_path:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Run\'
    selection_value:
        - TargetObject|contains: 'Microsift'
        - Details|contains: '.exe Platypus'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high