CurrentControlSet Autorun Keys Modification

Severity: medium
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source: upstream

Detects modification of autostart extensibility point (ASEP) in registry.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `all of system_control_base`

TargetObject|contains: '\SYSTEM\CurrentControlSet\Control'

Stage 2: `all of system_control_keys`

or:
TargetObject|contains: '\BootVerificationProgram\ImagePath'
TargetObject|contains: '\Lsa\Authentication Packages'
TargetObject|contains: '\Lsa\Notification Packages'
TargetObject|contains: '\NetworkProvider\Order'
TargetObject|contains: '\Print\Monitors'
TargetObject|contains: '\Print\Providers'
TargetObject|contains: '\SafeBoot\AlternateShell'
TargetObject|contains: '\SecurityProviders\SecurityProviders'
TargetObject|contains: '\Terminal Server\Wds\rdpwd\StartupPrograms'
TargetObject|contains: '\Terminal Server\WinStations\RDP-Tcp\InitialProgram'

Stage 3: `not 1 of filter_*`

or:
Details: ['CutePDF Writer', cpwmon64_v40.dll]
Image: 'C:\Windows\System32\spoolsv.exe'
TargetObject|contains: '\Print\Monitors\CutePDF Writer Monitor'
or:
User|contains: AUTHORI
User|contains: AUTORI
Image: 'C:\Windows\System32\spoolsv.exe'
TargetObject|contains: 'Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_'
Details: VNCpm.dll
Image: 'C:\Windows\System32\spoolsv.exe'
TargetObject|endswith: '\Print\Monitors\MONVNC\Driver'
Image: 'C:\Windows\System32\poqexec.exe'
TargetObject|endswith: '\NetworkProvider\Order\ProviderOrder'
Details: '(Empty)'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	eq	`(Empty)` corpus 24 (sigma 24) `CutePDF Writer` `VNCpm.dll` `cpwmon64_v40.dll` corpus 2 (sigma 2)
`Image`	eq	`C:\Windows\System32\poqexec.exe` corpus 7 (sigma 7) `C:\Windows\System32\spoolsv.exe` corpus 2 (sigma 2)
`TargetObject`	ends_with	`\NetworkProvider\Order\ProviderOrder` `\Print\Monitors\MONVNC\Driver`
`TargetObject`	match	`Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_` `\BootVerificationProgram\ImagePath` `\Lsa\Authentication Packages` `\Lsa\Notification Packages` `\NetworkProvider\Order` `\Print\Monitors` `\Print\Monitors\CutePDF Writer Monitor` `\Print\Providers` `\SYSTEM\CurrentControlSet\Control` `\SafeBoot\AlternateShell` `\SecurityProviders\SecurityProviders` `\Terminal Server\Wds\rdpwd\StartupPrograms` `\Terminal Server\WinStations\RDP-Tcp\InitialProgram`
`User`	match	`AUTHORI` corpus 16 (sigma 16) `AUTORI` corpus 16 (sigma 16)