Potential Provisioning Registry Key Abuse For Binary Proxy Execution

Title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution
Status: test
Description:Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  -https://twitter.com/0gtweet/status/1674399582162153472
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Date: 2023-08-08
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: 'SOFTWARE\Microsoft\Provisioning\Commands\'
  condition:selection
Falsepositives:
  -Unknown
Level: high