Potential Persistence Via App Paths Default Property

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.012` Event Triggered Execution: Image File Execution Options Injection
Privilege Escalation	`T1546.012` Event Triggered Execution: Image File Execution Options Injection

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

or:
Details|contains: '%temp%'
Details|contains: '%tmp%'
Details|contains: .bat
Details|contains: .dll
Details|contains: .hta
Details|contains: .ps1
Details|contains: Invoke-
Details|contains: '\AppData\Local\Temp\'
Details|contains: '\Desktop\'
Details|contains: '\Downloads\'
Details|contains: '\Users\Public'
Details|contains: '\Windows\Temp\'
Details|contains: cscript
Details|contains: iex
Details|contains: mshta
Details|contains: regsvr32
Details|contains: rundll32
Details|contains: wscript
or:
TargetObject|endswith: '(Default)'
TargetObject|endswith: Path
TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.