Potential Persistence Via AppCompat RegisterAppRestart Layer — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2024-01-01 / not supplied.

{
  "category": "registry_set",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7ed7ceea408fd455016188806aad01e81aa67525cedf68dc260b822ce876ae21

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Persistence Via AppCompat RegisterAppRestart Layer
id: b86852fb-4c77-48f9-8519-eb1b2c308b59
status: test
description: |
    Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.
    This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API.
    This can be potentially abused as a persistence mechanism.
references:
    - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-01-01
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.011
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\'
        Details|contains: 'REGISTERAPPRESTART'
    condition: selection
falsepositives:
    - Legitimate applications making use of this feature for compatibility reasons
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate applications making use of this feature for compatibility reasons

Source references

• https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md