Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

Title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
Status: test
Description:Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  -https://twitter.com/0gtweet/status/1674399582162153472
Author: Swachchhanda Shrawan Poudel
Date: 2023-08-02
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: registry_set
• product: windows
• definition: Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored

Detection:
  selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\Provisioning\Commands\'
  condition:selection
Falsepositives:
  -Unknown
Level: high