Sunturai
Back to results
MediumSigmaHQNasreddine Bencherchali (Nextron Systems)

Register New IFiltre For Persistence

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new…

Description

Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.

Detection logic

Detection requirements

Log source product
windows
Log source category
registry_set

Known benign triggers

  • Legitimate registration of IFilters by the OS or software

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice