Detection rules › Sigma

Potential Persistence Via AppCompat RegisterAppRestart Layer

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.011 Event Triggered Execution: Application Shimming
Privilege EscalationT1546.011 Event Triggered Execution: Application Shimming

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection

Details|contains: REGISTERAPPRESTART
TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • REGISTERAPPRESTART
TargetObjectmatch
  • \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\