Windows Registry: Suspicious Keyboard Layout Preload in User Session

Detects user-hive registry changes that preload Persian (Iranian) or Vietnamese keyboard layouts under Windows.

FreeUnreviewedSigmamediumv1

windows-registry-suspicious-keyboard-layout-preload-in-user-session-34aa0252

title: "Windows Registry: Suspicious Keyboard Layout Preload in User Session"
id: 7dbffcf4-f254-46c6-99c4-11a456fb54ef
status: test
description: This rule flags Registry writes that include the Keyboard Layout Preload (and Substitutes) paths under the current user hive, with details matching specific layout identifiers (Persian/Iranian and Vietnamese). Loading keyboard layouts via these entries can support attacker interaction by aligning input methods with targeted environments or user expectations. It relies on registry set telemetry capturing TargetObject and Details fields for changes under the \\Keyboard Layout\\Preload and \\Keyboard Layout\\Substitutes locations.
references:
  - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
  - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-12
modified: 2023-08-17
tags:
  - attack.resource-development
  - attack.t1588.002
logsource:
  category: registry_set
  product: windows
  definition: "Requirements: Sysmon config that monitors \\Keyboard Layout\\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files"
detection:
  selection_registry:
    TargetObject|contains:
      - \Keyboard Layout\Preload\
      - \Keyboard Layout\Substitutes\
    Details|contains:
      - 429
      - 50429
      - 0000042a
  condition: selection_registry
falsepositives:
  - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)
level: medium
license: DRL-1.1
related:
  - id: 34aa0252-6039-40ff-951f-939fd6ce47d8
    type: derived

What it detects

This rule flags Registry writes that include the Keyboard Layout Preload (and Substitutes) paths under the current user hive, with details matching specific layout identifiers (Persian/Iranian and Vietnamese). Loading keyboard layouts via these entries can support attacker interaction by aligning input methods with targeted environments or user expectations. It relies on registry set telemetry capturing TargetObject and Details fields for changes under the \\Keyboard Layout\\Preload and \\Keyboard Layout\\Substitutes locations.

Known false positives

Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.