Add Port Monitor Persistence in Registry

Severity: medium
Author: frack113
Source: upstream

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.010` Boot or Logon Autostart Execution: Port Monitors
Privilege Escalation	`T1547.010` Boot or Logon Autostart Execution: Port Monitors

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

Details|endswith: .dll
TargetObject|contains: '\Control\Print\Monitors\'

Stage 2: `not 1 of filter_optional_*`

or:
or:
User|contains: AUTHORI
User|contains: AUTORI
Details: cpwmon64_v40.dll
Image: 'C:\Windows\System32\spoolsv.exe'
TargetObject|contains: '\Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver'
TargetObject|contains: 'Control\Print\Environments\'
TargetObject|contains: '\Drivers\'
TargetObject|contains: '\VNC Printer'
TargetObject|contains: '\Control\Print\Monitors\MONVNC\Driver'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	ends_with	`.dll` corpus 3 (sigma 3)
`Details`	eq	`cpwmon64_v40.dll` corpus 2 (sigma 2)
`Image`	eq	`C:\Windows\System32\spoolsv.exe` corpus 2 (sigma 2)
`TargetObject`	match	`Control\Print\Environments\` `\Control\Print\Monitors\` `\Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver` `\Control\Print\Monitors\MONVNC\Driver` `\Drivers\` `\VNC Printer`
`User`	match	`AUTHORI` corpus 16 (sigma 16) `AUTORI` corpus 16 (sigma 16)