Detection rules › Sigma
Office Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: all of selection_office_root
or:
TargetObject|contains: '\Software\Microsoft\Office'
TargetObject|contains: '\Software\Wow6432Node\Microsoft\Office'
Stage 2: all of selection_office_details
or:
TargetObject|contains: '\Access\Addins'
TargetObject|contains: '\Excel\Addins'
TargetObject|contains: '\Onenote\Addins'
TargetObject|contains: '\Outlook\Addins'
TargetObject|contains: '\PowerPoint\Addins'
TargetObject|contains: '\Word\Addins'
TargetObject|contains: 'test\Special\Perf'
Stage 3: not 1 of filter_main_*
or:
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft Office\'
Image|startswith: 'C:\Program Files\Microsoft Office\'
Image|startswith: 'C:\Windows\System32\msiexec.exe'
Image|startswith: 'C:\Windows\System32\regsvr32.exe'
or:
TargetObject|contains: 'AddinTakeNotesService\FriendlyName'
TargetObject|contains: '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
TargetObject|contains: '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
TargetObject|contains: '\Excel\Addins\NativeShim.InquireConnector.1\'
TargetObject|contains: '\Excel\Addins\NativeShim\'
TargetObject|contains: '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
TargetObject|contains: '\Outlook\AddIns\AccessAddin.DC\'
TargetObject|contains: '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
TargetObject|contains: '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
TargetObject|contains: '\Outlook\AddIns\EvernoteOLRD.Connect\'
TargetObject|contains: '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
TargetObject|contains: '\Outlook\Addins\OcOffice.OcForms\'
TargetObject|contains: '\Outlook\Addins\OscAddin.Connect\'
TargetObject|contains: '\Outlook\Addins\OutlookChangeNotifier.Connect\'
TargetObject|contains: '\Outlook\Addins\UCAddin.LyncAddin.1'
TargetObject|contains: '\Outlook\Addins\UCAddin.UCAddin.1'
TargetObject|contains: '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
TargetObject|contains: '\Outlook\Addins\\OneNote.OutlookAddin'
or:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
Image|endswith: '\OfficeClickToRun.exe'
Details: '(Empty)'
Stage 4: not 1 of filter_optional_*
or:
Image: ['C:\Program Files\AVG\Antivirus\RegSvr.exe', 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
Image: ['C:\Program Files\Avast Software\Avast\RegSvr.exe', 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe']
TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Details | eq |
|
Image | ends_with |
|
Image | eq |
|
Image | starts_with |
|
TargetObject | match |
|