Windows Registry: Change to Services\WinSock2\Parameters\AutodialDLL for DLL Persistence
Alerts on registry changes to AutodialDLL under WinSock2 parameters that may enable DLL-based persistence.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-10
- Updated
- 2026-07-30
What it detects
This rule flags registry modifications to the AutodialDLL value under Services\WinSock2\Parameters. Changing this key can allow an attacker to cause a DLL load via the WinSock2-related mechanism, establishing persistence. It relies on registry_set telemetry that records the TargetObject path containing the specified AutodialDLL location.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-change-to-services-winsock2-parameters-autodialdll-for-dll-pers-e6fe26ee
title: "Windows Registry: Change to Services\\WinSock2\\Parameters\\AutodialDLL for DLL Persistence"
id: 16f5ad5b-6bf0-4441-8751-9e14d47cdc58
status: test
description: This rule flags registry modifications to the AutodialDLL value under Services\WinSock2\Parameters. Changing this key can allow an attacker to cause a DLL load via the WinSock2-related mechanism, establishing persistence. It relies on registry_set telemetry that records the TargetObject path containing the specified AutodialDLL location.
references:
- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
- https://persistence-info.github.io/Data/autodialdll.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-10
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\WinSock2\Parameters\AutodialDLL
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: e6fe26ee-d063-4f5b-b007-39e90aaf50e3
type: derived