[cor-b]

Summary of the Pull Request

Two rules have - :\ProgramData' with no opening quote (from #5196). YAML reads the value as :\ProgramData', so the ProgramData check never matches. The Splunk query built from the current rule searches for *:\ProgramData'*.

This PR adds the quote. With the check working, the Run key rule matched two installers in the baselines, so I added two filters:

• filter_main_burn_package_cache: WiX Burn RunOnce values ("C:\ProgramData\Package Cache\{GUID}\*.exe" /burn.runonce) written in HKLM by the Burn engine.
• filter_optional_squirrel_machine_installs: Discord's machine-wide installer (C:\ProgramData\SquirrelMachineInstalls\*.exe --checkInstall).

Tests:

• Windows Sandbox: the rules on master match 0 of 9 test events, the fixed rules match 9 of 9. This includes the signed WMIC.exe and a renamed copy for the OriginalFileName branch.
• All 7 baselines (v0.8.5): 0 matches. The existing regression test still passes.
• Six weeks of Sysmon data from two of my hosts, in Splunk: the fixed query matched only my test values.

Changelog

fix: New RUN Key Pointing to Suspicious Folder - restore the ProgramData quote, filter WiX Burn and Squirrel machine-wide installers
fix: Suspicious Autorun Registry Modified via WMI - restore the ProgramData quote

Example Log Event

Baseline event (win11-client) that the Burn filter removes:

EventID: 13
Image: C:\Windows\Temp\{F2727AE3-2D60-41DD-A19E-33D6B7A24626}\.be\windowsdesktop-runtime-6.0.1-win-x64.exe
TargetObject: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7037b699-7382-448c-89a7-4765961d2537}
Details: "C:\ProgramData\Package Cache\{7037b699-7382-448c-89a7-4765961d2537}\windowsdesktop-runtime-6.0.1-win-x64.exe" /burn.runonce

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions