Classes Autorun Keys Modification

Severity: medium
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source: upstream

Detects modification of autostart extensibility point (ASEP) in registry.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `all of selection_classes_base`

TargetObject|contains: '\Software\Classes'

Stage 2: `all of selection_classes_target`

or:
TargetObject|contains: '\.cmd'
TargetObject|contains: '\.exe'
TargetObject|contains: '\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance'
TargetObject|contains: '\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance'
TargetObject|contains: '\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance'
TargetObject|contains: '\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance'
TargetObject|contains: '\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers'
TargetObject|contains: '\Directory\Shellex\CopyHookHandlers'
TargetObject|contains: '\Directory\Shellex\DragDropHandlers'
TargetObject|contains: '\Exefile\Shell\Open\Command\(Default)'
TargetObject|contains: '\Filter'
TargetObject|contains: '\Folder\ShellEx\DragDropHandlers'
TargetObject|contains: '\Folder\ShellEx\ExtShellFolderViews'
TargetObject|contains: '\Folder\Shellex\ColumnHandlers'
TargetObject|contains: '\ShellEx\ContextMenuHandlers'
TargetObject|contains: '\ShellEx\PropertySheetHandlers'

Stage 3: `not 1 of filter_main_*`

or:
Image: 'C:\Windows\System32\svchost.exe'
TargetObject|contains: '\lnkfile\shellex\ContextMenuHandlers\'
Details: '(Empty)'
Details: null
Image: 'C:\Windows\System32\drvinst.exe'

Stage 4: `not 1 of filter_optional_msoffice`

Details: '{807583E5-5146-11D5-A672-00B0D022E945}'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	eq	`(Empty)` corpus 24 (sigma 24) `{807583E5-5146-11D5-A672-00B0D022E945}` corpus 2 (sigma 2)
`Image`	eq	`C:\Windows\System32\drvinst.exe` `C:\Windows\System32\svchost.exe` corpus 4 (sigma 4)
`TargetObject`	match	`\.cmd` `\.exe` `\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance` corpus 2 (sigma 2) `\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance` corpus 2 (sigma 2) `\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance` corpus 2 (sigma 2) `\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance` corpus 2 (sigma 2) `\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers` `\Directory\Shellex\CopyHookHandlers` corpus 2 (sigma 2) `\Directory\Shellex\DragDropHandlers` corpus 2 (sigma 2) `\Exefile\Shell\Open\Command\(Default)` `\Filter` `\Folder\ShellEx\DragDropHandlers` corpus 2 (sigma 2) `\Folder\ShellEx\ExtShellFolderViews` corpus 2 (sigma 2) `\Folder\Shellex\ColumnHandlers` `\ShellEx\ContextMenuHandlers` corpus 2 (sigma 2) `\ShellEx\PropertySheetHandlers` corpus 2 (sigma 2) `\Software\Classes` `\lnkfile\shellex\ContextMenuHandlers\`

Classes Autorun Keys Modification

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_classes_base

Stage 2: all of selection_classes_target

Stage 3: not 1 of filter_main_*

Stage 4: not 1 of filter_optional_msoffice

Indicators

Stage 1: `all of selection_classes_base`

Stage 2: `all of selection_classes_target`

Stage 3: `not 1 of filter_main_*`

Stage 4: `not 1 of filter_optional_msoffice`