Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Severity: medium
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source: upstream

Detects modification of autostart extensibility point (ASEP) in registry.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `all of selection_wow_nt_current_version_base`

TargetObject|contains: '\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion'

Stage 2: `all of selection_wow_nt_current_version`

or:
TargetObject|contains: '\Drivers32'
TargetObject|contains: '\Image File Execution Options'
TargetObject|contains: '\Windows\Appinit_Dlls'

Stage 3: `not 1 of filter_main_*`

or:
Details|endswith: '\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
Details: '(Empty)'
Details: null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	ends_with	`\Microsoft\Windows NT\CurrentVersion\Image File Execution Options`
`Details`	eq	`(Empty)` corpus 24 (sigma 24)
`TargetObject`	match	`\Drivers32` corpus 2 (sigma 2) `\Image File Execution Options` corpus 2 (sigma 2) `\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion` `\Windows\Appinit_Dlls` corpus 2 (sigma 2)