Possible Persistence Through AppCompat RegisterAppRestart Layer (via registry_set)

title: Possible Persistence Through AppCompat RegisterAppRestart Layer (via registry_set)
id: 6da926dd-ef60-55cb-906d-26dd26fd029a
status: stable
description: This rule detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer enables an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially misused as a persistence mechanism.
references:
    - https://attack.mitre.org/techniques/T1546/011/
    - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
author: Huntrule Team
date: 2026-06-24
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.011
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\'
        Details|contains: 'REGISTERAPPRESTART'
    condition: selection
falsepositives:
    - Unknown
level: medium