CurrentVersion NT Autorun Keys Modification

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

or:
TargetObject|contains: '\Drivers32'
TargetObject|contains: '\Font Drivers'
TargetObject|contains: '\Image File Execution Options'
TargetObject|contains: '\Windows\Appinit_Dlls'
TargetObject|contains: '\Windows\IconServiceLib'
TargetObject|contains: '\Windows\Load'
TargetObject|contains: '\Windows\Run'
TargetObject|contains: '\Winlogon\AlternateShells\AvailableShells'
TargetObject|contains: '\Winlogon\AppSetup'
TargetObject|contains: '\Winlogon\GpExtensions'
TargetObject|contains: '\Winlogon\Shell'
TargetObject|contains: '\Winlogon\Taskman'
TargetObject|contains: '\Winlogon\Userinit'
TargetObject|contains: '\Winlogon\VmApplet'

or:
Details: ['DWORD (0x00000001)', 'DWORD (0x00000009)', 'DWORD (0x000003c0)']
or:
TargetObject|contains: '\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval'
TargetObject|contains: '\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas'
Image: 'C:\Windows\system32\svchost.exe'
or:
TargetObject|endswith: '\DisableExceptionChainValidation'
TargetObject|endswith: '\MitigationOptions'
TargetObject|contains: '\Image File Execution Options\'
Image: 'C:\Windows\System32\RuntimeBroker.exe'
TargetObject|contains: '\runtimebroker.exe\Microsoft.Windows.ShellExperienceHost'
Details: '(Empty)'
Details: null
Image: 'C:\Windows\System32\poqexec.exe'

or:
Details: ['C:\Windows\system32\userinit.exe,', explorer.exe]
or:
Image|startswith: 'C:\Program Files (x86)\Avira\Antivirus\avguard.exe'
Image|startswith: 'C:\Program Files\Avira\Antivirus\avguard.exe'
or:
TargetObject|endswith: '\shell\UseAsDefault'
TargetObject|endswith: '\userinit\UseAsDefault'
TargetObject|contains: 'SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\'
or:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
Image|endswith: '\OfficeClickToRun.exe'
Details|endswith: '\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"'
Details|startswith: 'C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\'
Image|endswith: '\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe'
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary'
Image|endswith: '\MicrosoftEdgeUpdate.exe'
Image|startswith: 'C:\Program Files (x86)\Microsoft\Temp\'
Image|endswith: '\ngen.exe'
Image|startswith: 'C:\Windows\Microsoft.NET\Framework'
Image: 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
Image: 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
TargetObject|contains: '\ClickToRunStore\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\'
TargetObject|contains: '\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.