{"id":"34aa0252-6039-40ff-951f-939fd6ce47d8","title":"Suspicious Keyboard Layout Load","description":"Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-10-12","modified":"2023-08-17","tags":["attack.resource-development","attack.t1588.002"],"technique_ids":["T1588.002"],"logsource":{"category":"registry_set","product":"windows","definition":"Requirements: Sysmon config that monitors \\Keyboard Layout\\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files"},"falsepositives":["Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"],"references":["https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index","https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files"],"source_path":"rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml","source_sha256":"a9d2a09af51eb890aeb73172c412c0c0b6615da4806e4c8ed90eab7bc7902789","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Keyboard Layout Load\nid: 34aa0252-6039-40ff-951f-939fd6ce47d8\nstatus: test\ndescription: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only\nreferences:\n    - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index\n    - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-10-12\nmodified: 2023-08-17\ntags:\n    - attack.resource-development\n    - attack.t1588.002\nlogsource:\n    category: registry_set\n    product: windows\n    definition: 'Requirements: Sysmon config that monitors \\Keyboard Layout\\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'\ndetection:\n    selection_registry:\n        TargetObject|contains:\n            - '\\Keyboard Layout\\Preload\\'\n            - '\\Keyboard Layout\\Substitutes\\'\n        Details|contains:\n            - 00000429  # Persian (Iran)\n            - 00050429  # Persian (Iran)\n            - 0000042a  # Vietnamese\n    condition: selection_registry\nfalsepositives:\n    - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1588.002","id":"T1588.002","name":"Tool","page":"techniques/enterprise/T1588.002/"}],"data_path":"data/detection-rules/34aa0252-6039-40ff-951f-939fd6ce47d8.json","kind":"sigma"}