{"id":"cbf93e5d-ca6c-4722-8bea-e9119007c248","title":"CurrentVersion NT Autorun Keys Modification","description":"Detects modification of autostart extensibility point (ASEP) in registry.","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"source_path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml","source_sha256":"b5dfe568fe54a45a5a2eb4a893f8850703b81475b513782dc1bfa53e4c9e36ef","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: CurrentVersion NT Autorun Keys Modification\nid: cbf93e5d-ca6c-4722-8bea-e9119007c248\nrelated:\n    - id: 17f878b8-9968-4578-b814-c4217fc5768c\n      type: obsolete\nstatus: test\ndescription: Detects modification of autostart extensibility point (ASEP) in registry.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns\n    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys\nauthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)\ndate: 2019-10-25\nmodified: 2025-10-22\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_nt_current_version_base:\n        TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'\n    selection_nt_current_version:\n        TargetObject|contains:\n            - '\\Winlogon\\VmApplet'\n            - '\\Winlogon\\Userinit'\n            - '\\Winlogon\\Taskman'\n            - '\\Winlogon\\Shell'\n            - '\\Winlogon\\GpExtensions'\n            - '\\Winlogon\\AppSetup'\n            - '\\Winlogon\\AlternateShells\\AvailableShells'\n            - '\\Windows\\IconServiceLib'\n            - '\\Windows\\Appinit_Dlls'\n            - '\\Image File Execution Options' # Covered in better details in 36803969-5421-41ec-b92f-8500f79c23b0\n            - '\\Font Drivers'\n            - '\\Drivers32'\n            - '\\Windows\\Run'\n            - '\\Windows\\Load'\n    filter_main_empty:\n        Details: '(Empty)'\n    filter_main_null:\n        Details: null\n    filter_main_poqexec:\n        Image: 'C:\\Windows\\System32\\poqexec.exe'\n    filter_main_legitimate_subkey:  # Legitimately used subkeys of \\Image File Execution Options, which are not used for persistence (see https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/)\n        TargetObject|contains: '\\Image File Execution Options\\'\n        TargetObject|endswith:\n            - '\\DisableExceptionChainValidation'\n            - '\\MitigationOptions'\n    filter_main_security_extension_dc:\n        Image: 'C:\\Windows\\system32\\svchost.exe'\n        TargetObject|contains:\n            - '\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\PreviousPolicyAreas'\n            - '\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval'\n        Details:\n            - 'DWORD (0x00000001)'\n            - 'DWORD (0x00000009)'\n            - 'DWORD (0x000003c0)'\n    filter_main_runtimebroker:\n        Image: 'C:\\Windows\\System32\\RuntimeBroker.exe'\n        TargetObject|contains: '\\runtimebroker.exe\\Microsoft.Windows.ShellExperienceHost'\n    filter_optional_edge:\n        Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\Temp\\'\n        Image|endswith: '\\MicrosoftEdgeUpdate.exe'\n    filter_optional_avguard:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Avira\\Antivirus\\avguard.exe'\n            - 'C:\\Program Files\\Avira\\Antivirus\\avguard.exe'\n        TargetObject|contains: 'SOFTWARE\\WOW6432Node\\Avira\\Antivirus\\Overwrite_Keys\\HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\'\n        TargetObject|endswith:\n            - '\\userinit\\UseAsDefault'\n            - '\\shell\\UseAsDefault'\n        Details:\n            - 'explorer.exe'\n            - 'C:\\Windows\\system32\\userinit.exe,'\n    filter_optional_msoffice:\n        - TargetObject|contains:\n              - '\\ClickToRunStore\\HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\'\n              - '\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\'\n        - Image:\n              - 'C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe'\n              - 'C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe'\n    filter_optional_officeclicktorun:\n        Image|startswith:\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_optional_ngen:\n        Image|startswith: 'C:\\Windows\\Microsoft.NET\\Framework'\n        Image|endswith: '\\ngen.exe'\n    filter_optional_onedrive:\n        Image|endswith: '\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Update Binary'\n        Details|startswith: 'C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\'\n        Details|endswith: '\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason\n    - Legitimate administrator sets up autorun keys for legitimate reason\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/cbf93e5d-ca6c-4722-8bea-e9119007c248.json","kind":"sigma"}