Detection rules › Sigma
CurrentVersion Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: all of selection_current_version_base
TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion'
Stage 2: all of selection_current_version_keys
or:
TargetObject|contains: '\Authentication\Credential Provider Filters'
TargetObject|contains: '\Authentication\Credential Providers'
TargetObject|contains: '\Authentication\PLAP Providers'
TargetObject|contains: '\Explorer\Browser Helper Objects'
TargetObject|contains: '\Explorer\SharedTaskScheduler'
TargetObject|contains: '\Explorer\ShellExecuteHooks'
TargetObject|contains: '\Explorer\ShellIconOverlayIdentifiers'
TargetObject|contains: '\Explorer\ShellServiceObjects'
TargetObject|contains: '\Group Policy\Scripts\Logoff'
TargetObject|contains: '\Group Policy\Scripts\Logon'
TargetObject|contains: '\Group Policy\Scripts\Shutdown'
TargetObject|contains: '\Group Policy\Scripts\Startup'
TargetObject|contains: '\Policies\Explorer\Run'
TargetObject|contains: '\Policies\System\Shell'
TargetObject|contains: '\RunOnceEx\'
TargetObject|contains: '\RunOnce\'
TargetObject|contains: '\RunServicesOnce\'
TargetObject|contains: '\RunServices\'
TargetObject|contains: '\Run\'
TargetObject|contains: '\ShellServiceObjectDelayLoad'
Stage 3: not 1 of filter_main_*
or:
or:
TargetObject|contains: '\Authentication\Credential Providers\{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}\'
TargetObject|contains: '\Authentication\Credential Providers\{8AF662BF-65A0-4D0A-A540-A338A999D36F}\'
TargetObject|contains: '\Authentication\Credential Providers\{BEC09223-B018-416D-A0AC-523971B639F5}\'
TargetObject|contains: '\Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\'
Image: 'C:\Windows\system32\LogonUI.exe'
Details: 'ctfmon.exe /n'
Image: 'C:\Windows\system32\userinit.exe'
Details|contains: '\Microsoft\Teams\Update.exe --processStart '
Image|endswith: '\Microsoft\Teams\current\Teams.exe'
Details: '(Empty)'
Details: null
Image|endswith: '\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe'
Image|endswith: '\AppData\Local\WebEx\WebexHost.exe'
Image|endswith: '\AppData\Roaming\Spotify\Spotify.exe'
Image: 'C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe'
Image: 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
Image: 'C:\Program Files (x86)\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe'
Image: 'C:\Program Files (x86)\Microsoft OneDrive\Update\OneDriveSetup.exe'
Image: 'C:\Program Files\Everything\Everything.exe'
Image: 'C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe'
Image: 'C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe'
Image: 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
Image: 'C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe'
Image: 'C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe'
Image: 'C:\Program Files\Windows Defender\MsMpEng.exe'
Image: 'C:\WINDOWS\system32\devicecensus.exe'
Image: 'C:\Windows\system32\winsat.exe'
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\'
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\'
Image|startswith: 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
TargetObject|endswith: '\NgcFirst\ConsecutiveSwitchCount'
Stage 4: not 1 of filter_optional_*
or:
Details: ['C:\Program Files (x86)\Opera\launcher.exe', 'C:\Program Files\Opera\launcher.exe']
TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable'
Details: ['"C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe" /gui', '"C:\Program Files\AVG\Antivirus\AvLaunch.exe" /gui', '{472083B0-C522-11CF-8763-00608CC02F24}', '{472083B1-C522-11CF-8763-00608CC02F24}']
or:
Image|contains: 'C:\Program Files (x86)\AVG\Antivirus\Setup\'
Image|contains: 'C:\Program Files\AVG\Antivirus\Setup\'
Image|contains: '\instup.exe'
Details: ['"C:\Program Files (x86)\Avast Software\Avast\AvLaunch.exe" /gui', '"C:\Program Files\Avast Software\Avast\AvLaunch.exe" /gui']
or:
Image|contains: 'C:\Program Files (x86)\Avast Software\Avast\Setup\'
Image|contains: 'C:\Program Files\Avast Software\Avast\Setup\'
Image|contains: '\instup.exe'
Details: ['{51EF1569-67EE-4AD6-9646-E726C3FFC8A2}', '{A8E52322-8734-481D-A7E2-27B309EF8D56}', '{C973DA94-CBDF-4E77-81D1-E5B794FBD146}', '{CFE8B367-77A7-41D7-9C90-75D16D7DC6B6}']
TargetObject|contains: GoogleDrive
or:
Details|startswith: 'C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\'
Details|startswith: 'C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\'
Details|contains: '\AppData\Local\Microsoft\OneDrive\'
or:
Image|endswith: '\aurora-agent-64.exe'
Image|endswith: '\aurora-agent.exe'
Details: 'C:\Program Files\Aurora-Agent\tools\aurora-dashboard.exe'
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Run\aurora-dashboard'
Image: ['C:\Program Files (x86)\AVG\Antivirus\avgToolsSvc.exe', 'C:\Program Files\AVG\Antivirus\avgToolsSvc.exe']
Details: 'Binary Data'
TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\'
or:
Image|startswith: 'C:\Program Files (x86)\Common Files\Microsoft Shared\ClickToRun\'
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
Details|endswith: '.exe" /burn.runonce'
Details|contains: '\AppData\Local\Package Cache\{'
Details|contains: '}\python-'
TargetObject|contains: '\Microsoft\Windows\CurrentVersion\RunOnce\{'
Details|endswith: 'A251-47B7-93E1-CDD82E34AF8B}'
Image: 'C:\Windows\system32\regsvr32.exe'
TargetObject|contains: DropboxExt
Details|endswith: '\Discord\Update.exe --processStart Discord.exe'
TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\Discord'
Details|endswith: '\Everything\Everything.exe" -startup'
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Run\Everything'
Details: 'C:\Program Files\Greenshot\Greenshot.exe'
TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Greenshot'
Details: 'C:\Program Files\Opera\assistant\browser_assistant.exe'
TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Browser Assistant'
Details: '"C:\Program Files\Zoom\bin\installer.exe" /repair'
TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zoommsirepair'
Details: "C:\Program Files\iTunes\iTunesHelper.exe"
TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper'
Details|contains: '\GoogleDriveFS.exe'
Details|startswith: 'C:\Program Files\Google\Drive File Stream\'
TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\GoogleDriveFS'
Details|contains: '\Microsoft\Teams\Update.exe --processStart'
Image|endswith: '\Microsoft\Teams\current\Teams.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Details | ends_with |
|
Details | eq |
|
Details | match |
|
Details | starts_with |
|
Image | ends_with |
|
Image | eq |
|
Image | match |
|
Image | starts_with |
|
TargetObject | ends_with |
|
TargetObject | match |
|