{"id":"b86852fb-4c77-48f9-8519-eb1b2c308b59","title":"Potential Persistence Via AppCompat RegisterAppRestart Layer","description":"Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.\nThis compatibility layer allows an application to register for restart using the \"RegisterApplicationRestart\" API.\nThis can be potentially abused as a persistence mechanism.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-01-01","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.011"],"technique_ids":["T1546.011"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate applications making use of this feature for compatibility reasons"],"references":["https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml","source_sha256":"7ed7ceea408fd455016188806aad01e81aa67525cedf68dc260b822ce876ae21","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via AppCompat RegisterAppRestart Layer\nid: b86852fb-4c77-48f9-8519-eb1b2c308b59\nstatus: test\ndescription: |\n    Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.\n    This compatibility layer allows an application to register for restart using the \"RegisterApplicationRestart\" API.\n    This can be potentially abused as a persistence mechanism.\nreferences:\n    - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-01-01\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.011\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\\'\n        Details|contains: 'REGISTERAPPRESTART'\n    condition: selection\nfalsepositives:\n    - Legitimate applications making use of this feature for compatibility reasons\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","page":"techniques/enterprise/T1546.011/"}],"data_path":"data/detection-rules/b86852fb-4c77-48f9-8519-eb1b2c308b59.json","kind":"sigma"}