
title: Autorun Keys Modification
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin,
  oscd.community, Tim Shelton
date: 2019/10/25
description: Detects modification of autostart extensibility point (ASEP) in registry.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_10:
    TargetObject:
    - '*\Winlogon\VmApplet*'
    - '*\Winlogon\Userinit*'
    - '*\Winlogon\Taskman*'
    - '*\Winlogon\Shell*'
    - '*\Winlogon\GpExtensions*'
    - '*\Winlogon\AppSetup*'
    - '*\Winlogon\AlternateShells\AvailableShells*'
    - '*\Windows\IconServiceLib*'
    - '*\Windows\Appinit_Dlls*'
    - '*\Image File Execution Options*'
    - '*\Font Drivers*'
    - '*\Drivers32*'
    - '*\Windows\Run*'
    - '*\Windows\Load*'
  SELECTION_11:
    TargetObject: '*\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion*'
  SELECTION_12:
    TargetObject:
    - '*\ShellServiceObjectDelayLoad*'
    - '*\Run*'
    - '*\Explorer\ShellServiceObjects*'
    - '*\Explorer\ShellIconOverlayIdentifiers*'
    - '*\Explorer\ShellExecuteHooks*'
    - '*\Explorer\SharedTaskScheduler*'
    - '*\Explorer\Browser Helper Objects*'
  SELECTION_13:
    TargetObject: '*\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion*'
  SELECTION_14:
    TargetObject:
    - '*\Windows\Appinit_Dlls*'
    - '*\Image File Execution Options*'
    - '*\Drivers32*'
  SELECTION_15:
    EventID: 12
  SELECTION_16:
    EventID: 13
  SELECTION_17:
    EventID: 14
  SELECTION_18:
    TargetObject: '*\Software\Wow6432Node\Microsoft\Office*'
  SELECTION_19:
    TargetObject: '*\Software\Microsoft\Office*'
  SELECTION_2:
    EventID: 13
  SELECTION_20:
    TargetObject:
    - '*\Word\Addins*'
    - '*\PowerPoint\Addins*'
    - '*\Outlook\Addins*'
    - '*\Onenote\Addins*'
    - '*\Excel\Addins*'
    - '*\Access\Addins*'
    - '*test\Special\Perf*'
  SELECTION_21:
    EventID: 12
  SELECTION_22:
    EventID: 13
  SELECTION_23:
    EventID: 14
  SELECTION_24:
    TargetObject: '*\Software\Wow6432Node\Microsoft\Internet Explorer*'
  SELECTION_25:
    TargetObject: '*\Software\Microsoft\Internet Explorer*'
  SELECTION_26:
    TargetObject:
    - '*\Toolbar*'
    - '*\Extensions*'
    - '*\Explorer Bars*'
  SELECTION_27:
    TargetObject: '*\Software\Wow6432Node\Classes*'
  SELECTION_28:
    TargetObject:
    - '*\Folder\ShellEx\ExtShellFolderViews*'
    - '*\Folder\ShellEx\DragDropHandlers*'
    - '*\Folder\ShellEx\ColumnHandlers*'
    - '*\Directory\Shellex\DragDropHandlers*'
    - '*\Directory\Shellex\CopyHookHandlers*'
    - '*\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance*'
    - '*\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance*'
    - '*\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance*'
    - '*\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance*'
    - '*\AllFileSystemObjects\ShellEx\DragDropHandlers*'
    - '*\ShellEx\PropertySheetHandlers*'
    - '*\ShellEx\ContextMenuHandlers*'
  SELECTION_29:
    TargetObject: '*\Software\Classes*'
  SELECTION_3:
    EventID: 14
  SELECTION_30:
    TargetObject:
    - '*\Folder\ShellEx\ExtShellFolderViews*'
    - '*\Folder\ShellEx\DragDropHandlers*'
    - '*\Folder\Shellex\ColumnHandlers*'
    - '*\Filter*'
    - '*\Exefile\Shell\Open\Command\(Default)*'
    - '*\Directory\Shellex\DragDropHandlers*'
    - '*\Directory\Shellex\CopyHookHandlers*'
    - '*\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance*'
    - '*\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance*'
    - '*\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance*'
    - '*\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance*'
    - '*\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers*'
    - '*\.exe*'
    - '*\.cmd*'
    - '*\ShellEx\PropertySheetHandlers*'
    - '*\ShellEx\ContextMenuHandlers*'
  SELECTION_31:
    TargetObject: '*\Software\Policies\Microsoft\Windows\System\Scripts*'
  SELECTION_32:
    TargetObject:
    - '*\Startup*'
    - '*\Shutdown*'
    - '*\Logon*'
    - '*\Logoff*'
  SELECTION_33:
    TargetObject: '*\System\CurrentControlSet\Services\WinSock2\Parameters*'
  SELECTION_34:
    TargetObject:
    - '*\Protocol_Catalog9\Catalog_Entries*'
    - '*\NameSpace_Catalog5\Catalog_Entries*'
  SELECTION_35:
    TargetObject: '*\SYSTEM\CurrentControlSet\Control*'
  SELECTION_36:
    TargetObject:
    - '*\Terminal Server\WinStations\RDP-Tcp\InitialProgram*'
    - '*\Terminal Server\Wds\rdpwd\StartupPrograms*'
    - '*\SecurityProviders\SecurityProviders*'
    - '*\SafeBoot\AlternateShell*'
    - '*\Print\Providers*'
    - '*\Print\Monitors*'
    - '*\NetworkProvider\Order*'
    - '*\Lsa\Notification Packages*'
    - '*\Lsa\Authentication Packages*'
    - '*\BootVerificationProgram\ImagePath*'
  SELECTION_37:
    Details: (Empty)
  SELECTION_38:
    TargetObject: '*\NgcFirst\ConsecutiveSwitchCount'
  SELECTION_4:
    TargetObject:
    - '*\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStart*'
    - '*\Software\Wow6432Node\Microsoft\Command Processor\Autorun*'
    - '*\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components*'
    - '*\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnDisconnect*'
    - '*\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect*'
    - '*\SYSTEM\Setup\CmdLine*'
    - '*\Software\Microsoft\Ctf\LangBarAddin*'
    - '*\Software\Microsoft\Command Processor\Autorun*'
    - '*\SOFTWARE\Microsoft\Active Setup\Installed Components*'
    - '*\SOFTWARE\Classes\Protocols\Handler*'
    - '*\SOFTWARE\Classes\Protocols\Filter*'
    - '*\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)*'
    - '*\Environment\UserInitMprLogonScript*'
    - '*\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\Scrnsave.exe*'
    - '*\Software\Microsoft\Internet Explorer\UrlSearchHooks*'
    - '*\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components*'
    - '*\Software\Classes\Clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Inprocserver32*'
    - '*\Control Panel\Desktop\Scrnsave.exe*'
  SELECTION_5:
    TargetObject: '*\System\CurrentControlSet\Control\Session Manager*'
  SELECTION_6:
    TargetObject:
    - '*\SetupExecute*'
    - '*\S0InitialCommand*'
    - '*\KnownDlls*'
    - '*\Execute*'
    - '*\BootExecute*'
    - '*\AppCertDlls*'
  SELECTION_7:
    TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion*'
  SELECTION_8:
    TargetObject:
    - '*\ShellServiceObjectDelayLoad*'
    - '*\Run*'
    - '*\Policies\System\Shell*'
    - '*\Policies\Explorer\Run*'
    - '*\Group Policy\Scripts\Startup*'
    - '*\Group Policy\Scripts\Shutdown*'
    - '*\Group Policy\Scripts\Logon*'
    - '*\Group Policy\Scripts\Logoff*'
    - '*\Explorer\ShellServiceObjects*'
    - '*\Explorer\ShellIconOverlayIdentifiers*'
    - '*\Explorer\ShellExecuteHooks*'
    - '*\Explorer\SharedTaskScheduler*'
    - '*\Explorer\Browser Helper Objects*'
    - '*\Authentication\PLAP Providers*'
    - '*\Authentication\Credential Providers*'
    - '*\Authentication\Credential Provider Filters*'
  SELECTION_9:
    TargetObject: '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and ((((((((((((SELECTION_4
    or (SELECTION_5 and SELECTION_6)) or (SELECTION_7 and SELECTION_8)) or (SELECTION_9
    and SELECTION_10)) or (SELECTION_11 and SELECTION_12)) or (SELECTION_13 and SELECTION_14))
    or ((SELECTION_15 or SELECTION_16 or SELECTION_17) and (SELECTION_18 or SELECTION_19)
    and SELECTION_20)) or ((SELECTION_21 or SELECTION_22 or SELECTION_23) and (SELECTION_24
    or SELECTION_25) and SELECTION_26)) or (SELECTION_27 and SELECTION_28)) or (SELECTION_29
    and SELECTION_30)) or (SELECTION_31 and SELECTION_32)) or (SELECTION_33 and SELECTION_34))
    or ((SELECTION_35 and SELECTION_36) and  not (SELECTION_37 or SELECTION_38))))
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun
  keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
fields:
- SecurityID
- ObjectName
- OldValueType
- NewValueType
id: 17f878b8-9968-4578-b814-c4217fc5768c
level: medium
logsource:
  category: registry_event
  product: windows
modified: 2021/11/20
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md
- https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
status: experimental
tags:
- attack.persistence
- attack.t1547.001
- attack.t1060
ruletype: SIGMA
