Windows Registry CurrentVersion Autostart/Run Key Modification Monitoring

Alerts on registry writes to Windows CurrentVersion autostart and Run/RunOnce persistence keys, excluding known benign patterns.

FreeUnreviewedSigmamediumv1

windows-registry-currentversion-autostart-run-key-modification-monitoring-20f0ee37

title: Windows Registry CurrentVersion Autostart/Run Key Modification Monitoring
id: b73f46aa-571c-4f7a-978a-1e5f4a2af659
related:
  - id: 17f878b8-9968-4578-b814-c4217fc5768c
    type: obsolete
  - id: 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
    type: derived
status: test
description: This rule flags changes to registry autorun locations under the Windows CurrentVersion hive, including common persistence points such as Run, RunOnce, RunServices, and policy/script startup entries. It matters because attackers frequently establish persistence by writing commands or extensibility values that execute at logon, startup, or via shell execution behavior. The detection relies on registry-set telemetry that provides the TargetObject being modified plus related process Image and Details fields used to filter known benign installers and system activity.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_current_version_base:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion
  selection_current_version_keys:
    TargetObject|contains:
      - \ShellServiceObjectDelayLoad
      - \Run\
      - \RunOnce\
      - \RunOnceEx\
      - \RunServices\
      - \RunServicesOnce\
      - \Policies\System\Shell
      - \Policies\Explorer\Run
      - \Group Policy\Scripts\Startup
      - \Group Policy\Scripts\Shutdown
      - \Group Policy\Scripts\Logon
      - \Group Policy\Scripts\Logoff
      - \Explorer\ShellServiceObjects
      - \Explorer\ShellIconOverlayIdentifiers
      - \Explorer\ShellExecuteHooks
      - \Explorer\SharedTaskScheduler
      - \Explorer\Browser Helper Objects
      - \Authentication\PLAP Providers
      - \Authentication\Credential Providers
      - \Authentication\Credential Provider Filters
  filter_main_generic_all:
    - Details: (Empty)
    - TargetObject|endswith: \NgcFirst\ConsecutiveSwitchCount
    - Image|endswith:
        - \AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
        - \AppData\Roaming\Spotify\Spotify.exe
        - \AppData\Local\WebEx\WebexHost.exe
    - Image:
        - C:\WINDOWS\system32\devicecensus.exe
        - C:\Windows\system32\winsat.exe
        - C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe
        - C:\Program Files (x86)\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe
        - C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe
        - C:\Program Files (x86)\Microsoft OneDrive\Update\OneDriveSetup.exe
        - C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe
        - C:\Program Files (x86)\Microsoft Office\root\integration\Addons\OneDriveSetup.exe
        - C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe
        - C:\Program Files\Everything\Everything.exe
        - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
        - C:\Program Files\Microsoft Office\root\integration\integrator.exe
  filter_main_null:
    Details: null
  filter_main_logonui:
    Image: C:\Windows\system32\LogonUI.exe
    TargetObject|contains:
      - \Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\
      - \Authentication\Credential Providers\{BEC09223-B018-416D-A0AC-523971B639F5}\
      - \Authentication\Credential Providers\{8AF662BF-65A0-4D0A-A540-A338A999D36F}\
      - \Authentication\Credential Providers\{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}\
  filter_main_edge:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\
      - C:\Program Files (x86)\Microsoft\EdgeWebView\
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  filter_main_defender:
    Image: C:\Program Files\Windows Defender\MsMpEng.exe
  filter_main_teams:
    Image|endswith: \Microsoft\Teams\current\Teams.exe
    Details|contains: "\\Microsoft\\Teams\\Update.exe --processStart "
  filter_main_ctfmon:
    Image: C:\Windows\system32\userinit.exe
    Details: ctfmon.exe /n
  filter_optional_dropbox:
    Image: C:\Windows\system32\regsvr32.exe
    TargetObject|contains: DropboxExt
    Details|endswith: A251-47B7-93E1-CDD82E34AF8B}
  filter_optional_opera_1:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Browser Assistant
    Details: C:\Program Files\Opera\assistant\browser_assistant.exe
  filter_optional_opera_2:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable
    Details:
      - C:\Program Files\Opera\launcher.exe
      - C:\Program Files (x86)\Opera\launcher.exe
  filter_optional_itunes:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper
    Details: '"C:\Program Files\iTunes\iTunesHelper.exe"'
  filter_optional_zoom:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zoommsirepair
    Details: '"C:\Program Files\Zoom\bin\installer.exe" /repair'
  filter_optional_greenshot:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Greenshot
    Details: C:\Program Files\Greenshot\Greenshot.exe
  filter_optional_googledrive1:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Run\GoogleDriveFS
    Details|startswith: C:\Program Files\Google\Drive File Stream\
    Details|contains: \GoogleDriveFS.exe
  filter_optional_googledrive2:
    TargetObject|contains: GoogleDrive
    Details:
      - "{CFE8B367-77A7-41D7-9C90-75D16D7DC6B6}"
      - "{A8E52322-8734-481D-A7E2-27B309EF8D56}"
      - "{C973DA94-CBDF-4E77-81D1-E5B794FBD146}"
      - "{51EF1569-67EE-4AD6-9646-E726C3FFC8A2}"
  filter_optional_onedrive:
    Details|startswith:
      - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\
      - C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\
    Details|contains: \AppData\Local\Microsoft\OneDrive\
  filter_optional_python:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\{
    Details|contains|all:
      - \AppData\Local\Package Cache\{
      - "}\\python-"
    Details|endswith: .exe" /burn.runonce
  filter_optional_officeclicktorun:
    Image|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
      - C:\Program Files (x86)\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_optional_teams:
    Image|endswith: \Microsoft\Teams\current\Teams.exe
    Details|contains: \Microsoft\Teams\Update.exe --processStart
  filter_optional_AVG_setup:
    Image|contains:
      - C:\Program Files\AVG\Antivirus\Setup\
      - C:\Program Files (x86)\AVG\Antivirus\Setup\
      - \instup.exe
    Details:
      - '"C:\Program Files\AVG\Antivirus\AvLaunch.exe" /gui'
      - '"C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe" /gui'
      - "{472083B0-C522-11CF-8763-00608CC02F24}"
      - "{472083B1-C522-11CF-8763-00608CC02F24}"
  filter_optional_Avast:
    Image|contains:
      - C:\Program Files\Avast Software\Avast\Setup\
      - C:\Program Files (x86)\Avast Software\Avast\Setup\
      - \instup.exe
    Details:
      - '"C:\Program Files\Avast Software\Avast\AvLaunch.exe" /gui'
      - '"C:\Program Files (x86)\Avast Software\Avast\AvLaunch.exe" /gui'
  filter_optional_AVG_avgtoolsvc:
    Image:
      - C:\Program Files\AVG\Antivirus\avgToolsSvc.exe
      - C:\Program Files (x86)\AVG\Antivirus\avgToolsSvc.exe
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\
    Details: Binary Data
  filter_optional_aurora_dashboard:
    Image|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
    TargetObject|endswith: \Microsoft\Windows\CurrentVersion\Run\aurora-dashboard
    Details: C:\Program Files\Aurora-Agent\tools\aurora-dashboard.exe
  filter_optional_everything:
    TargetObject|endswith: \Microsoft\Windows\CurrentVersion\Run\Everything
    Details|endswith: \Everything\Everything.exe" -startup
  filter_optional_discord:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Run\Discord
    Details|endswith: \Discord\Update.exe --processStart Discord.exe
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
  - Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1

What it detects

This rule flags changes to registry autorun locations under the Windows CurrentVersion hive, including common persistence points such as Run, RunOnce, RunServices, and policy/script startup entries. It matters because attackers frequently establish persistence by writing commands or extensibility values that execute at logon, startup, or via shell execution behavior. The detection relies on registry-set telemetry that provides the TargetObject being modified plus related process Image and Details fields used to filter known benign installers and system activity.

Known false positives

Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
Legitimate administrator sets up autorun keys for legitimate reason

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.