Detection rules › Sigma
Run Once Task Configuration in Registry
Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1112 Modify Registry |
| Defense Evasion | T1112 Modify Registry |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 12 | RegistryEvent (Object create and delete) |
| Sysmon | 13 | RegistryEvent (Value Set) |
| Sysmon | 14 | RegistryEvent (Key and Value Rename) |
Stages and Predicates
Stage 1: selection
TargetObject|endswith: '\StubPath'
TargetObject|contains: '\Microsoft\Active Setup\Installed Components'
Stage 2: not 1 of filter_optional_*
or:
or:
Details|contains: 'C:\Program Files (x86)\Microsoft\Edge\Application\'
Details|contains: 'C:\Program Files\Microsoft\Edge\Application\'
Details|endswith: '\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable'
Details|contains: 'C:\Program Files\Google\Chrome\Application\'
Details|contains: '\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Details | ends_with |
|
Details | match |
|
TargetObject | ends_with |
|
TargetObject | match |
|