Suspicious Path In Keyboard Layout IME File Registry Value
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "\Control\Keyboard Layouts" AND OBJECTNAME contains "Ime File") OR (OBJECTNAME endswith "\Control\Keyboard Layouts" AND isExist(OBJECTVALUENAME))) AND (INFORMATION contains ":\Perflogs\,:\Users\Public\,:\Windows\Temp\,\AppData\Local\Temp\,\AppData\Roaming\,\Temporary Internet" OR ((INFORMATION contains ":\Users" AND INFORMATION contains "\Favorites") OR (INFORMATION contains ":\Users" AND INFORMATION contains "\Favourites") OR (INFORMATION contains ":\Users" AND INFORMATION contains "\Contacts"))) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
X__Junior (Nextron Systems)
