From 634895a844904f82eaa30dc1b0a7ac35a7383e9f Mon Sep 17 00:00:00 2001
From: Matt Williams <13837569+mwilliams31@users.noreply.github.com>
Date: Fri, 27 Sep 2024 11:57:05 -0400
Subject: [PATCH] New rule: open-recentdocs-registry-key.yml

---
 nursery/open-recentdocs-registry-key.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 nursery/open-recentdocs-registry-key.yml

diff --git a/nursery/open-recentdocs-registry-key.yml b/nursery/open-recentdocs-registry-key.yml
new file mode 100644
index 00000000..87ff12f9
--- /dev/null
+++ b/nursery/open-recentdocs-registry-key.yml
@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: open RecentDocs registry key
+    namespace: host-interaction/registry
+    authors:
+      - matthew.williams@mandiant.com
+    description: In the example sample, a RecentDocs registry value was leveraged for anti-sandbox purposes. See the referenced Palo Alto blog for details.
+    scopes:
+      static: basic block
+      dynamic: call
+    mbc:
+      - Operating System::Registry::Open Registry Key [C0036.003]
+    references:
+      - https://www.magnetforensics.com/blog/what-is-mru-most-recently-used/
+      - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
+    # examples:
+      # - cb948b13a5046a692ec3ed8cc16a9566:0x140016dc9 (dynamic)
+  features:
+    - and:
+      - match: create or open registry key
+      - string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs/i
\ No newline at end of file