Windows Registry Autorun/ASEP Key Modification for Persistence
Alerts on registry modifications to common Windows autorun and persistence extensibility keys indicative of auto-start behavior.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name) (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry writes or changes to common Windows autostart extensibility and persistence locations by matching specific registry paths in the TargetObject field. Attackers commonly use these autorun and extensibility points to execute code automatically after logon, disconnect/connect events, or via protocol and script hooks. It relies on Windows registry set telemetry (category: registry_set) and path-based matching, with exclusions intended to reduce noise from known legitimate components and install-time activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- gist.github.comhttps://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- persistence-info.github.iohttps://persistence-info.github.io/Data/userinitmprlogonscript.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-autorun-asep-key-modification-for-persistence-f59c3faf
title: Windows Registry Autorun/ASEP Key Modification for Persistence
id: b0edc1a5-9a98-41ca-b670-46f5ca7619ab
related:
- id: 17f878b8-9968-4578-b814-c4217fc5768c
type: obsolete
- id: f59c3faf-50f3-464b-9f4c-1b67ab512d99
type: derived
status: test
description: "This rule flags registry writes or changes to common Windows autostart extensibility and persistence locations by matching specific registry paths in the TargetObject field. Attackers commonly use these autorun and extensibility points to execute code automatically after logon, disconnect/connect events, or via protocol and script hooks. It relies on Windows registry set telemetry (category: registry_set) and path-based matching, with exclusions intended to reduce noise from known legitimate components and install-time activity."
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- https://persistence-info.github.io/Data/userinitmprlogonscript.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStart
- \Software\Wow6432Node\Microsoft\Command Processor\Autorun
- \SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
- \SOFTWARE\Microsoft\Windows CE Services\AutoStartOnDisconnect
- \SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect
- \SYSTEM\Setup\CmdLine
- \Software\Microsoft\Ctf\LangBarAddin
- \Software\Microsoft\Command Processor\Autorun
- \SOFTWARE\Microsoft\Active Setup\Installed Components
- \SOFTWARE\Classes\Protocols\Handler
- \SOFTWARE\Classes\Protocols\Filter
- \SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)
- \Environment\UserInitMprLogonScript
- \SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\Scrnsave.exe
- \Software\Microsoft\Internet Explorer\UrlSearchHooks
- \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
- \Software\Classes\Clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Inprocserver32
- \Control Panel\Desktop\Scrnsave.exe
filter_main_empty:
Details: (Empty)
filter_main_null:
Details: null
filter_main_poqexec:
Image: C:\Windows\System32\poqexec.exe
filter_optional_msoffice:
- TargetObject|contains:
- \Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Handler\
- \ClickToRunStore\HKMU\SOFTWARE\Classes\PROTOCOLS\Handler\
- Details:
- "{314111c7-a502-11d2-bbca-00c04f8ec294}"
- "{3459B272-CC19-4448-86C9-DDC3B4B2FAD3}"
- "{42089D2D-912D-4018-9087-2B87803E93FB}"
- "{5504BE45-A83B-4808-900A-3A5C36E7F77A}"
- "{807583E5-5146-11D5-A672-00B0D022E945}"
filter_optional_chrome:
TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}
filter_optional_edge:
TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}
filter_optional_IE:
TargetObject|contains: \Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
filter_optional_integrator:
Image:
- C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
- C:\Program Files\Microsoft Office\root\integration\integrator.exe
filter_optional_office:
Image|startswith:
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
Image|endswith: \OfficeClickToRun.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1