Narrator's Feedback-Hub Persistence

Title: Narrator's Feedback-Hub Persistence
Status: test
Description:Detects abusing Windows 10 Narrator's Feedback-Hub
References:
  -https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
Author: Dmitriy Lifanov, oscd.community
Date: 2019-10-25
modified:2022-03-26
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.001'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection1:
    EventType: 'DeleteValue'
    TargetObject|endswith: '\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute'
  selection2:
    TargetObject|endswith: '\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default)'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high