Detection rules › Sigma

Office Autorun Keys Modification

Severity
medium
Author
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source
upstream

Detects modification of autostart extensibility point (ASEP) in registry.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege EscalationT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: all of selection_office_root

or:
TargetObject|contains: '\Software\Microsoft\Office'
TargetObject|contains: '\Software\Wow6432Node\Microsoft\Office'

Stage 2: all of selection_office_details

or:
TargetObject|contains: '\Access\Addins'
TargetObject|contains: '\Excel\Addins'
TargetObject|contains: '\Onenote\Addins'
TargetObject|contains: '\Outlook\Addins'
TargetObject|contains: '\PowerPoint\Addins'
TargetObject|contains: '\Word\Addins'
TargetObject|contains: 'test\Special\Perf'

Stage 3: not 1 of filter_main_*

or:
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft Office\'
Image|startswith: 'C:\Program Files\Microsoft Office\'
Image|startswith: 'C:\Windows\System32\msiexec.exe'
Image|startswith: 'C:\Windows\System32\regsvr32.exe'
or:
TargetObject|contains: 'AddinTakeNotesService\FriendlyName'
TargetObject|contains: '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
TargetObject|contains: '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
TargetObject|contains: '\Excel\Addins\NativeShim.InquireConnector.1\'
TargetObject|contains: '\Excel\Addins\NativeShim\'
TargetObject|contains: '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
TargetObject|contains: '\Outlook\AddIns\AccessAddin.DC\'
TargetObject|contains: '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
TargetObject|contains: '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
TargetObject|contains: '\Outlook\AddIns\EvernoteOLRD.Connect\'
TargetObject|contains: '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
TargetObject|contains: '\Outlook\Addins\OcOffice.OcForms\'
TargetObject|contains: '\Outlook\Addins\OscAddin.Connect\'
TargetObject|contains: '\Outlook\Addins\OutlookChangeNotifier.Connect\'
TargetObject|contains: '\Outlook\Addins\UCAddin.LyncAddin.1'
TargetObject|contains: '\Outlook\Addins\UCAddin.UCAddin.1'
TargetObject|contains: '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
TargetObject|contains: '\Outlook\Addins\\OneNote.OutlookAddin'
or:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
Image|endswith: '\OfficeClickToRun.exe'
Details: '(Empty)'

Stage 4: not 1 of filter_optional_*

or:
Image: ['C:\Program Files\AVG\Antivirus\RegSvr.exe', 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
Image: ['C:\Program Files\Avast Software\Avast\RegSvr.exe', 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailseq
  • (Empty) corpus 24 (sigma 24)
Imageends_with
  • \OfficeClickToRun.exe corpus 10 (sigma 10)
Imageeq
  • C:\Program Files\AVG\Antivirus\RegSvr.exe corpus 3 (sigma 3)
  • C:\Program Files\AVG\Antivirus\x86\RegSvr.exe corpus 2 (sigma 2)
  • C:\Program Files\Avast Software\Avast\RegSvr.exe corpus 3 (sigma 3)
  • C:\Program Files\Avast Software\Avast\x86\RegSvr.exe corpus 2 (sigma 2)
Imagestarts_with
  • C:\Program Files (x86)\Microsoft Office\ corpus 3 (sigma 3)
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ corpus 8 (sigma 8)
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ corpus 5 (sigma 5)
  • C:\Program Files\Microsoft Office\ corpus 3 (sigma 3)
  • C:\Windows\System32\msiexec.exe
  • C:\Windows\System32\regsvr32.exe
TargetObjectmatch
  • AddinTakeNotesService\FriendlyName
  • \Access\Addins
  • \Excel\Addins
  • \Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\
  • \Excel\Addins\ExcelPlugInShell.PowerMapConnect\
  • \Excel\Addins\NativeShim.InquireConnector.1\
  • \Excel\Addins\NativeShim\
  • \Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\
  • \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ corpus 2 (sigma 2)
  • \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ corpus 2 (sigma 2)
  • \Onenote\Addins
  • \Outlook\AddIns\AccessAddin.DC\
  • \Outlook\AddIns\ColleagueImport.ColleagueImportAddin\
  • \Outlook\AddIns\EvernoteCC.EvernoteContactConnector\
  • \Outlook\AddIns\EvernoteOLRD.Connect\
  • \Outlook\Addins
  • \Outlook\Addins\Microsoft.VbaAddinForOutlook.1\
  • \Outlook\Addins\OcOffice.OcForms\
  • \Outlook\Addins\OscAddin.Connect\
  • \Outlook\Addins\OutlookChangeNotifier.Connect\
  • \Outlook\Addins\UCAddin.LyncAddin.1
  • \Outlook\Addins\UCAddin.UCAddin.1
  • \Outlook\Addins\UmOutlookAddin.FormRegionAddin\
  • \Outlook\Addins\\OneNote.OutlookAddin
  • \PowerPoint\Addins
  • \Software\Microsoft\Office
  • \Software\Wow6432Node\Microsoft\Office
  • \Word\Addins
  • test\Special\Perf