Windows Registry Autorun/ASEP Key Modification for Persistence

title: Windows Registry Autorun/ASEP Key Modification for Persistence
id: b0edc1a5-9a98-41ca-b670-46f5ca7619ab
related:
  - id: 17f878b8-9968-4578-b814-c4217fc5768c
    type: obsolete
  - id: f59c3faf-50f3-464b-9f4c-1b67ab512d99
    type: derived
status: test
description: "This rule flags registry writes or changes to common Windows autostart extensibility and persistence locations by matching specific registry paths in the TargetObject field. Attackers commonly use these autorun and extensibility points to execute code automatically after logon, disconnect/connect events, or via protocol and script hooks. It relies on Windows registry set telemetry (category: registry_set) and path-based matching, with exclusions intended to reduce noise from known legitimate components and install-time activity."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://persistence-info.github.io/Data/userinitmprlogonscript.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStart
      - \Software\Wow6432Node\Microsoft\Command Processor\Autorun
      - \SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
      - \SOFTWARE\Microsoft\Windows CE Services\AutoStartOnDisconnect
      - \SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect
      - \SYSTEM\Setup\CmdLine
      - \Software\Microsoft\Ctf\LangBarAddin
      - \Software\Microsoft\Command Processor\Autorun
      - \SOFTWARE\Microsoft\Active Setup\Installed Components
      - \SOFTWARE\Classes\Protocols\Handler
      - \SOFTWARE\Classes\Protocols\Filter
      - \SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)
      - \Environment\UserInitMprLogonScript
      - \SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\Scrnsave.exe
      - \Software\Microsoft\Internet Explorer\UrlSearchHooks
      - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
      - \Software\Classes\Clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Inprocserver32
      - \Control Panel\Desktop\Scrnsave.exe
  filter_main_empty:
    Details: (Empty)
  filter_main_null:
    Details: null
  filter_main_poqexec:
    Image: C:\Windows\System32\poqexec.exe
  filter_optional_msoffice:
    - TargetObject|contains:
        - \Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Handler\
        - \ClickToRunStore\HKMU\SOFTWARE\Classes\PROTOCOLS\Handler\
    - Details:
        - "{314111c7-a502-11d2-bbca-00c04f8ec294}"
        - "{3459B272-CC19-4448-86C9-DDC3B4B2FAD3}"
        - "{42089D2D-912D-4018-9087-2B87803E93FB}"
        - "{5504BE45-A83B-4808-900A-3A5C36E7F77A}"
        - "{807583E5-5146-11D5-A672-00B0D022E945}"
  filter_optional_chrome:
    TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}
  filter_optional_edge:
    TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}
  filter_optional_IE:
    TargetObject|contains: \Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
  filter_optional_integrator:
    Image:
      - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
      - C:\Program Files\Microsoft Office\root\integration\integrator.exe
  filter_optional_office:
    Image|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
    Image|endswith: \OfficeClickToRun.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
  - Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1