{"id":"707e097c-e20f-4f67-8807-1f72ff4500d6","title":"Potential Persistence Via App Paths Default Property","description":"Detects changes to the \"Default\" property for keys located in the \\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ registry. Which might be used as a method of persistence\nThe entries found under App Paths are used primarily for the following purposes.\nFirst, to map an application's executable file name to that file's fully qualified path.\nSecond, to prepend information to the PATH environment variable on a per-application, per-process basis.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-10","modified":"2023-08-17","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.012"],"technique_ids":["T1546.012"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)"],"references":["https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/","https://learn.microsoft.com/en-us/windows/win32/shell/app-registration"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml","source_sha256":"91b4cac04919d422c334573385b1fb5685d9e2d8dd6f95ea992f0feaf43ee72c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via App Paths Default Property\nid: 707e097c-e20f-4f67-8807-1f72ff4500d6\nstatus: test\ndescription: |\n    Detects changes to the \"Default\" property for keys located in the \\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ registry. Which might be used as a method of persistence\n    The entries found under App Paths are used primarily for the following purposes.\n    First, to map an application's executable file name to that file's fully qualified path.\n    Second, to prepend information to the PATH environment variable on a per-application, per-process basis.\nreferences:\n    - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/\n    - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-10\nmodified: 2023-08-17\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.012\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths'\n        TargetObject|endswith:\n            - '(Default)'\n            - 'Path'\n        Details|contains:\n            # Add more suspicious paths or binaries as you see fit.\n            - '\\Users\\Public'\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Windows\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '%temp%'\n            - '%tmp%'\n            - 'iex'\n            - 'Invoke-'\n            - 'rundll32'\n            - 'regsvr32'\n            - 'mshta'\n            - 'cscript'\n            - 'wscript'\n            - '.bat'\n            - '.hta'\n            - '.dll'\n            - '.ps1'\n    condition: selection\nfalsepositives:\n    - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.012","id":"T1546.012","name":"Image File Execution Options Injection","page":"techniques/enterprise/T1546.012/"}],"data_path":"data/detection-rules/707e097c-e20f-4f67-8807-1f72ff4500d6.json","kind":"sigma"}