Possible Run Once Task Execution as Configured in Registry (via process_creation)

title: Possible Run Once Task Execution as Configured in Registry (via process_creation)
id: 4e6104a6-fa66-538a-b14c-c481a8040d3a
status: stable
description: This rule detects this rule detects the execution of Run Once task as configured in the registry
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://twitter.com/pabraeken/status/990717080805789697
    - https://lolbas-project.github.io/lolbas/Binaries/Runonce/
    - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA
author: 'Huntrule Team'
date: 2026-07-03
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\runonce.exe'
        - Description: 'Run Once Wrapper'
    selection_cli:
        - CommandLine|contains: '/AlternateShellStartup'
        - CommandLine|endswith: '/r'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low