{"id":"b29aed60-ebd1-442b-9cb5-16a1d0324adb","title":"Wow6432Node CurrentVersion Autorun Keys Modification","description":"Detects modification of autostart extensibility point (ASEP) in registry.","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-12-08","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d","https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"],"source_path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml","source_sha256":"5f82dff774e7286971fb6af432b05a8cec12e4b255417faff7038a97af9b58c7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Wow6432Node CurrentVersion Autorun Keys Modification\nid: b29aed60-ebd1-442b-9cb5-16a1d0324adb\nrelated:\n    - id: 17f878b8-9968-4578-b814-c4217fc5768c\n      type: obsolete\nstatus: test\ndescription: Detects modification of autostart extensibility point (ASEP) in registry.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns\n    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys\n    - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/\nauthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)\ndate: 2019-10-25\nmodified: 2025-12-08\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_wow_current_version_base:\n        TargetObject|contains: '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion'\n    selection_wow_current_version_keys:\n        TargetObject|contains:\n            - '\\ShellServiceObjectDelayLoad'\n            - '\\Run\\'\n            - '\\RunOnce\\'\n            - '\\RunOnceEx\\'\n            - '\\RunServices\\'\n            - '\\RunServicesOnce\\'\n            - '\\Explorer\\ShellServiceObjects'\n            - '\\Explorer\\ShellIconOverlayIdentifiers'\n            - '\\Explorer\\ShellExecuteHooks'\n            - '\\Explorer\\SharedTaskScheduler'\n            - '\\Explorer\\Browser Helper Objects'\n    filter_main_empty:\n        Details: '(Empty)'\n    filter_main_null:\n        Details: null\n    filter_main_ms_win_desktop_runtime:\n        Details|startswith: '\"C:\\ProgramData\\Package Cache\\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\\windowsdesktop-runtime-'\n    filter_main_vcredist:\n        Image|endswith: '\\VC_redist.x64.exe'\n        Details|endswith: '}\\VC_redist.x64.exe\" /burn.runonce'\n    filter_main_upgrades:\n        Image|startswith:\n            - 'C:\\ProgramData\\Package Cache'\n            - 'C:\\Windows\\Temp\\'\n        Image|contains:\n            - '\\winsdksetup.exe'\n            - '\\windowsdesktop-runtime-'  # C:\\WINDOWS\\Temp\\{751E2E78-46DC-4376-9205-99219CDC34AE}\\.be\\windowsdesktop-runtime-6.0.12-win-x86.exe\n            - '\\AspNetCoreSharedFrameworkBundle-'  # \"C:\\ProgramData\\Package Cache\\{b52191c1-a9c0-4b34-9a4e-930c2dd8a540}\\AspNetCoreSharedFrameworkBundle-x86.exe\" /burn.runonce\n        Details|endswith: ' /burn.runonce'\n    filter_main_uninstallers:\n        # This image path is linked with different uninstallers when running as admin unfortunately\n        Image|startswith: 'C:\\Windows\\Installer\\MSI'\n        TargetObject|contains: '\\Explorer\\Browser Helper Objects'\n    filter_main_msiexec:\n        Image: 'C:\\WINDOWS\\system32\\msiexec.exe'\n        TargetObject|contains: '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n    filter_main_edge:\n        Image|contains|all:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{'\n            - '\\setup.exe'\n    filter_optional_msoffice1:\n        Image: 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe'\n        TargetObject|contains: '\\Office\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\'\n    filter_optional_msoffice2:\n        Image:\n            - 'C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe'\n        TargetObject|contains: '\\Explorer\\Browser Helper Objects\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\'\n    filter_optional_dropbox:\n        - Details|endswith: '-A251-47B7-93E1-CDD82E34AF8B}'\n        - Details: 'grpconv -o'\n        - Details|contains|all:\n              - 'C:\\Program Files'\n              - '\\Dropbox\\Client\\Dropbox.exe'\n              - ' /systemstartup'\n    filter_optional_evernote:\n        TargetObject|endswith: '\\Explorer\\Browser Helper Objects\\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}\\NoExplorer'\n    filter_optional_dotnet:\n        Image|contains: '\\windowsdesktop-runtime-'\n        TargetObject|endswith:\n            - '\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\{e2d1ae32-dd1d-4ad7-a298-10e42e7840fc}'\n            - '\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\{7037b699-7382-448c-89a7-4765961d2537}'\n        Details|startswith: '\"C:\\ProgramData\\Package Cache\\'\n        Details|endswith: '.exe\" /burn.runonce'\n    filter_optional_office:\n        Image|startswith:\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_optional_discord:\n        TargetObject|endswith: '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Discord'\n        Details|endswith: 'Discord.exe --checkInstall'\n    filter_optional_avira:\n        Details|endswith: '\\Avira.OE.Setup.Bundle.exe\" /burn.runonce'\n        Image|endswith: '\\Avira.OE.Setup.Bundle.exe'\n    filter_optional_avg_1:\n        Image|endswith: '\\instup.exe'\n        TargetObject|endswith: '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\AvRepair'\n        Details|endswith: 'instup.exe\" /instop:repair /wait'\n    filter_optional_avg_2:\n        Image|endswith: '\\instup.exe'\n        TargetObject|endswith:\n            - '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\00avg\\(Default)'\n            - '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers\\00asw\\(Default)'\n        Details:\n            - '{472083B1-C522-11CF-8763-00608CC02F24}'\n            - '{472083B0-C522-11CF-8763-00608CC02F24}'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason\n    - Legitimate administrator sets up autorun keys for legitimate reason\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/b29aed60-ebd1-442b-9cb5-16a1d0324adb.json","kind":"sigma"}