Windows Registry Persistence Indicators in Event Viewer Events.asp Links

title: Windows Registry Persistence Indicators in Event Viewer Events.asp Links
id: 0da9a93e-bf53-44a5-ba58-cbd4ebb448f7
status: test
description: This rule identifies registry values associated with the Windows Event Viewer redirection components that reference Events.asp via specific Event Viewer-related registry paths. Such persistence/defense-impairment behavior matters because it can redirect users from legitimate event viewing or related content to attacker-controlled or manipulated destinations. It relies on registry change/set telemetry that captures the TargetObject and Details fields, along with process Image context to filter known benign GPO-controlled entries.
references:
  - https://twitter.com/nas_bench/status/1626648985824788480
  - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks
  - https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
  - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-17
modified: 2023-03-05
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram
      - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionURL
  filter_default_redirect_program:
    Image|endswith: C:\WINDOWS\system32\svchost.exe
    TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram
    Details: "%%SystemRoot%%\\PCHealth\\HelpCtr\\Binaries\\HelpCtr.exe"
  filter_default_redirect_program_cli:
    Image|endswith: C:\WINDOWS\system32\svchost.exe
    TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgramCommandLineParameters
    Details: -url hcp://services/centers/support?topic=%%s
  filter_url:
    Details: http://go.microsoft.com/fwlink/events.asp
  filter_cleaner:
    Details: (Empty)
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a1e11042-a74a-46e6-b07c-c4ce8ecc239b
    type: derived