
title: Direct Autorun Keys Modification
author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community
date: 2019/10/25
description: Detects direct modification of autostart extensibility point (ASEP) in
  registry using reg.exe.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\reg.exe'
  SELECTION_3:
    CommandLine: '*add*'
  SELECTION_4:
    CommandLine:
    - '*\software\Microsoft\Windows\CurrentVersion\Run*'
    - '*\software\Microsoft\Windows\CurrentVersion\RunOnce*'
    - '*\software\Microsoft\Windows\CurrentVersion\RunOnceEx*'
    - '*\software\Microsoft\Windows\CurrentVersion\RunServices*'
    - '*\software\Microsoft\Windows\CurrentVersion\RunServicesOnce*'
    - '*\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit*'
    - '*\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell*'
    - '*\software\Microsoft\Windows NT\CurrentVersion\Windows*'
    - '*\software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders*'
    - '*\system\CurrentControlSet\Control\SafeBoot\AlternateShell*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun
  keys for legitimate reasons.
- Legitimate administrator sets up autorun keys for legitimate reasons.
fields:
- CommandLine
- ParentCommandLine
id: 24357373-078f-44ed-9ac4-6d334a668a11
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2019/11/10
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md
status: experimental
tags:
- attack.persistence
- attack.t1547.001
- attack.t1060
ruletype: SIGMA
