Windows Registry Event: Implant Service Key Under CurrentControlSet\services\null\Instance

title: "Windows Registry Event: Implant Service Key Under CurrentControlSet\\services\\null\\Instance"
id: 08877975-d3ec-4a84-bf75-5788c703c26c
status: test
description: This rule flags Windows registry changes where the target path contains \SYSTEM\CurrentControlSet\services\null\Instance, consistent with persistence or configuration staging for a Windows implant. Attackers can use registry-stored service parameters to influence how code is started or managed on the host. Detection relies on registry event telemetry that captures the TargetObject field in Windows registry events.
references:
  - https://wikileaks.org/vault7/#Pandemic
  - https://twitter.com/MalwareJake/status/870349480356454401
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Pandemic/registry_event_apt_pandemic.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-06-01
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \SYSTEM\CurrentControlSet\services\null\Instance
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 47e0852a-cf81-4494-a8e6-31864f8c86ed
    type: derived