
title: Registry Persistence via Explorer Run Key
author: Florian Roth, oscd.community
date: 2018/07/18
description: Detects a possible persistence mechanism using RUN key for Windows Explorer
  and pointing to a suspicious folder
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
  SELECTION_5:
    Details:
    - C:\Windows\Temp\\*
    - C:\ProgramData\\*
    - C:\$Recycle.bin\\*
    - C:\Temp\\*
    - C:\Users\Public\\*
    - C:\Users\Default\\*
  SELECTION_6:
    Details:
    - '*\AppData\\*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and (SELECTION_5
    or SELECTION_6))
falsepositives:
- Unknown
fields:
- Image
- ParentImage
id: b7916c2a-fa2f-4795-9477-32b731f70f11
level: high
logsource:
  category: registry_event
  product: windows
modified: 2020/09/06
references:
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
status: experimental
tags:
- attack.persistence
- attack.t1060
- attack.t1547.001
ruletype: SIGMA
