{"id":"944e8941-f6f6-4ee8-ac05-1c224e923c0e","title":"Add Port Monitor Persistence in Registry","description":"Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.\nA port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.\n","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":"2024-03-25","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.010"],"technique_ids":["T1547.010"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md"],"source_path":"rules/windows/registry/registry_set/registry_set_add_port_monitor.yml","source_sha256":"2ca72e54922ee915882348af50a0fe1ada94516e0d142e8015520087c2ef5e99","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_add_port_monitor.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Add Port Monitor Persistence in Registry\nid: 944e8941-f6f6-4ee8-ac05-1c224e923c0e\nstatus: test\ndescription: |\n    Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.\n    A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md\nauthor: frack113\ndate: 2021-12-30\nmodified: 2024-03-25\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.010\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Control\\Print\\Monitors\\'\n        Details|endswith: '.dll'\n    filter_optional_cutepdf:\n        Image: 'C:\\Windows\\System32\\spoolsv.exe'\n        TargetObject|contains: '\\Control\\Print\\Monitors\\CutePDF Writer Monitor v4.0\\Driver'\n        Details: 'cpwmon64_v40.dll'\n        User|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n    filter_optional_monvnc:\n        TargetObject|contains: '\\Control\\Print\\Monitors\\MONVNC\\Driver'\n    filter_optional_vnc:\n        TargetObject|contains|all:\n            - 'Control\\Print\\Environments\\'\n            - '\\Drivers\\'\n            - '\\VNC Printer'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Add Port Monitor persistence in Registry\n      technique: T1547.010\n      atomic_guid: d34ef297-f178-4462-871e-9ce618d44e50\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.010","id":"T1547.010","name":"Port Monitors","page":"techniques/enterprise/T1547.010/"}],"data_path":"data/detection-rules/944e8941-f6f6-4ee8-ac05-1c224e923c0e.json","kind":"sigma"}