Windows Registry: Modification of Windows NT CurrentVersion Autostart Extensibility Points

Alerts on Windows registry changes to Winlogon/ASEP-related keys under Windows NT CurrentVersion that may enable persistence.

FreeReviewedSigma · Medium · v1

Product: windows
Category: registry_set
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) (SigmaHQ), DRL 1.1
Published: 2019-10-25
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags registry writes that modify autostart extensibility point (ASEP) locations under Windows NT CurrentVersion, particularly common Winlogon autostart-related subkeys and selected autorun paths. Such changes matter because attackers can abuse these registry-based start extensibility points to establish persistence or influence process execution at logon. The detection relies on registry set telemetry, matching the TargetObject path and excluding known benign cases and specific legitimate tool-driven paths.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Malicious Run Key Persistence Referencing DLL in User Documents

PlugX Persistence via Run Key Named AAM Updatevlm

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Persistence Run Key Pointing to svchost.exe in AppData Roaming

URL Shortcut File Created in Startup Folder for Persistence

Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos

Windows Registry: Modification of Windows NT CurrentVersion Autostart Extensibility Points

Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-modification-of-windows-nt-currentversion-autostart-extensibili-cbf93e5d

title: "Windows Registry: Modification of Windows NT CurrentVersion Autostart Extensibility Points"
id: 540295bd-34a7-4b96-97cf-369155f8be27
related:
  - id: 17f878b8-9968-4578-b814-c4217fc5768c
    type: obsolete
  - id: cbf93e5d-ca6c-4722-8bea-e9119007c248
    type: derived
status: test
description: This rule flags registry writes that modify autostart extensibility point (ASEP) locations under Windows NT CurrentVersion, particularly common Winlogon autostart-related subkeys and selected autorun paths. Such changes matter because attackers can abuse these registry-based start extensibility points to establish persistence or influence process execution at logon. The detection relies on registry set telemetry, matching the TargetObject path and excluding known benign cases and specific legitimate tool-driven paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_nt_current_version_base:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion
  selection_nt_current_version:
    TargetObject|contains:
      - \Winlogon\VmApplet
      - \Winlogon\Userinit
      - \Winlogon\Taskman
      - \Winlogon\Shell
      - \Winlogon\GpExtensions
      - \Winlogon\AppSetup
      - \Winlogon\AlternateShells\AvailableShells
      - \Windows\IconServiceLib
      - \Windows\Appinit_Dlls
      - \Image File Execution Options
      - \Font Drivers
      - \Drivers32
      - \Windows\Run
      - \Windows\Load
  filter_main_empty:
    Details: (Empty)
  filter_main_null:
    Details: null
  filter_main_poqexec:
    Image: C:\Windows\System32\poqexec.exe
  filter_main_legitimate_subkey:
    TargetObject|contains: \Image File Execution Options\
    TargetObject|endswith:
      - \DisableExceptionChainValidation
      - \MitigationOptions
  filter_main_security_extension_dc:
    Image: C:\Windows\system32\svchost.exe
    TargetObject|contains:
      - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas
      - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval
    Details:
      - DWORD (0x00000001)
      - DWORD (0x00000009)
      - DWORD (0x000003c0)
  filter_main_runtimebroker:
    Image: C:\Windows\System32\RuntimeBroker.exe
    TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost
  filter_optional_edge:
    Image|startswith: C:\Program Files (x86)\Microsoft\Temp\
    Image|endswith: \MicrosoftEdgeUpdate.exe
  filter_optional_avguard:
    Image|startswith:
      - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
      - C:\Program Files\Avira\Antivirus\avguard.exe
    TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
    TargetObject|endswith:
      - \userinit\UseAsDefault
      - \shell\UseAsDefault
    Details:
      - explorer.exe
      - C:\Windows\system32\userinit.exe,
  filter_optional_msoffice:
    - TargetObject|contains:
        - \ClickToRunStore\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
        - \ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\
    - Image:
        - C:\Program Files\Microsoft Office\root\integration\integrator.exe
        - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
  filter_optional_officeclicktorun:
    Image|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
      - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
    Image|endswith: \OfficeClickToRun.exe
  filter_optional_ngen:
    Image|startswith: C:\Windows\Microsoft.NET\Framework
    Image|endswith: \ngen.exe
  filter_optional_onedrive:
    Image|endswith: \AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
    TargetObject|endswith: \Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary
    Details|startswith: C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\
    Details|endswith: \AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
  - Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL