huntrule

Windows Registry Markers in HARDWARE Keys and PrintResponsor Path

Detects registry activity referencing specific HARDWARE marker GUID keys and the Setup\PrintResponsor path on Windows.

FreeUnreviewedSigmacriticalv1
title: Windows Registry Markers in HARDWARE Keys and PrintResponsor Path
id: b54071b7-ca24-404a-80f0-af615d4f32fe
status: test
description: This rule flags Windows registry modifications that target specific marker subkeys under the HARDWARE hive and a SYSTEM path related to Setup\PrintResponsor. Attackers can use registry locations to persist configuration and coordinate components such as input-capture malware modules. The detection relies on Windows registry event telemetry capturing the TargetObject values that contain the listed key paths.
references:
  - https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml
author: NVISO, Huntrule Team
date: 2020-06-09
modified: 2024-03-20
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains:
      - \HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}
      - \HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}
      - \HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}
      - \SYSTEM\Setup\PrintResponsor\
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 5118765f-6657-4ddb-a487-d7bd673abbf1
    type: derived

What it detects

This rule flags Windows registry modifications that target specific marker subkeys under the HARDWARE hive and a SYSTEM path related to Setup\PrintResponsor. Attackers can use registry locations to persist configuration and coordinate components such as input-capture malware modules. The detection relies on Windows registry event telemetry capturing the TargetObject values that contain the listed key paths.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.