Suspicious Path In Keyboard Layout IME File Registry Value

Title: Suspicious Path In Keyboard Layout IME File Registry Value
Status: test
Description:Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
References:
  -https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
Author: X__Junior (Nextron Systems)
Date: 2023-11-21
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection_registry:
    TargetObject|contains|all:
      -'\Control\Keyboard Layouts\'
      -'Ime File'

  selection_folders_1:
    Details|contains:
      -':\Perflogs\'
      -':\Users\Public\'
      -':\Windows\Temp\'
      -'\AppData\Local\Temp\'
      -'\AppData\Roaming\'
      -'\Temporary Internet'

  selection_folders_2:
    - Details|contains|all:
      - ':\Users\'
      - '\Favorites\'
    - Details|contains|all:
      - ':\Users\'
      - '\Favourites\'
    - Details|contains|all:
      - ':\Users\'
      - '\Contacts\'
  condition:selection_registry and 1 of selection_folders_*
Falsepositives:
  -Unknown
Level: high