Suspicious WinSock2 Autorun Keys Change (via registry_set)

title: Suspicious WinSock2 Autorun Keys Change (via registry_set)
id: 096fac0c-4eab-50bc-8e3c-c0da1a52d34a
status: stable
description: This rule detects modification of autostart extensibility point (ASEP) in registry.
references:
    - https://attack.mitre.org/techniques/T1547/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
author: Huntrule Team
date: 2026-02-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    winsock_parameters_base:
        TargetObject|contains: '\System\CurrentControlSet\Services\WinSock2\Parameters'
    winsock_parameters:
        TargetObject|contains:
            - '\Protocol_Catalog9\Catalog_Entries'
            - '\NameSpace_Catalog5\Catalog_Entries'
    filter:
        - Details: '(Empty)'
        - Image: 'C:\Windows\System32\MsiExec.exe'
        - Image: 'C:\Windows\syswow64\MsiExec.exe'
    condition: winsock_parameters_base and winsock_parameters and not filter
falsepositives:
    - Unknown
level: medium