Windows Registry: Seed Value under Cryptography Providers Path Persistence

title: "Windows Registry: Seed Value under Cryptography Providers Path Persistence"
id: 46bedf6b-cca5-43aa-92c4-0518f04de34c
status: test
description: This rule detects Windows registry value set activity targeting a value named "Seed" within the \SOFTWARE\Microsoft\Cryptography\Providers\{...\} key path. Attackers can use this kind of configuration persistence mechanism to establish or maintain malicious behavior across reboots, and registry change telemetry is central to catching it. The detection relies on registry set events that populate the TargetObject and value Details fields, while excluding events where Details contains "(Empty)".
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_configuration.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1553.003
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Cryptography\Providers\{
    TargetObject|endswith: \Seed
  filter_main_empty:
    Details|contains: (Empty)
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd
    type: derived