Windows Registry: Uncommon IME File Value in Keyboard Layouts Path

Alerts on Control\Keyboard Layouts\ registry values named "Ime File" that reference non-.ime extensions.

FreeUnreviewedSigmahighv1

windows-registry-uncommon-ime-file-value-in-keyboard-layouts-path-b888e3f2

title: "Windows Registry: Uncommon IME File Value in Keyboard Layouts Path"
id: 70871636-fb71-4fa6-aa18-c22d8abf91b9
related:
  - id: 9d8f9bb8-01af-4e15-a3a2-349071530530
    type: derived
  - id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1
    type: derived
status: test
description: This rule flags Windows registry writes that set the value name "Ime File" under the Control\Keyboard Layouts\ path. Attackers can abuse the IME keyboard layout mechanism to cause a process to load a DLL associated with that registry configuration, following an input language change request. The detection relies on Windows registry set telemetry, matching the registry key path and the presence of the "Ime File" value name, while filtering out entries that end with a known ".ime" extension.
references:
  - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_ime_non_default_extension.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-11-21
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains|all:
      - \Control\Keyboard Layouts\
      - Ime File
  filter_main_known_extension:
    Details|endswith: .ime
  condition: selection and not 1 of filter_main_*
falsepositives:
  - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
level: high
license: DRL-1.1

What it detects

This rule flags Windows registry writes that set the value name "Ime File" under the Control\Keyboard Layouts\ path. Attackers can abuse the IME keyboard layout mechanism to cause a process to load a DLL associated with that registry configuration, following an input language change request. The detection relies on Windows registry set telemetry, matching the registry key path and the presence of the "Ime File" value name, while filtering out entries that end with a known ".ime" extension.

Known false positives

IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.