Windows Registry Set: New User Profile Created with ANONYMOUS and _DomainUser_ Markers

title: "Windows Registry Set: New User Profile Created with ANONYMOUS and _DomainUser_ Markers"
id: 05009d67-b91a-4466-a097-697987648325
status: test
description: This rule flags Windows registry modifications to ProfileList entries where ProfileImagePath-related values include 'ANONYMOUS' and '_DomainUser_'. Creating or tampering with user profile records can help persistence and user-context staging for malware. Detection relies on registry_set telemetry capturing writes under the ProfileList S-1-5-21 subtree and matching those specific string markers in the modified data.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/registry_set_malware_coldsteel_created_users.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
modified: 2023-08-17
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-
      - \ProfileImagePath
    Details|contains:
      - ANONYMOUS
      - _DomainUser_
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 95214813-4c7a-4a50-921b-ee5c538e1d16
    type: derived