Windows Registry Run Key Persistence with Small Sieve Typos in Value Data

Flags registry Run-key writes on Windows with Small Sieve-specific typo and executable detail strings in value data.

FreeUnreviewedSigmahighv1

windows-registry-run-key-persistence-with-small-sieve-typos-in-value-data-65c6e3c1

title: Windows Registry Run Key Persistence with Small Sieve Typos in Value Data
id: 370823d0-d40f-42e9-80ab-e8441d111df4
status: test
description: This rule matches Windows registry set events targeting the CurrentVersion\Run location where the value data includes a specific misspelling and an executable detail string associated with Small Sieve. Attackers commonly abuse Run keys for persistence so the malware auto-starts after user logon. The detection relies on registry write telemetry containing the TargetObject path and the value fields (TargetObject and Details) observed during the change.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/registry_set_malware_small_sieve_evasion_typo.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
modified: 2023-08-17
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection_path:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\Run\
  selection_value:
    - TargetObject|contains: Microsift
    - Details|contains: .exe Platypus
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 65c6e3c1-fb28-4c03-a51e-84919d8185f1
    type: derived

What it detects

This rule matches Windows registry set events targeting the CurrentVersion\Run location where the value data includes a specific misspelling and an executable detail string associated with Small Sieve. Attackers commonly abuse Run keys for persistence so the malware auto-starts after user logon. The detection relies on registry write telemetry containing the TargetObject path and the value fields (TargetObject and Details) observed during the change.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.