Windows Registry Persistence via AppCompatFlags Layers REGISTERAPPRESTART

Detects registry persistence settings that include the AppCompat layer "REGISTERAPPRESTART" on Windows.

FreeUnreviewedSigmamediumv1

windows-registry-persistence-via-appcompatflags-layers-registerapprestart-b86852fb

title: Windows Registry Persistence via AppCompatFlags Layers REGISTERAPPRESTART
id: 168a9c91-74b6-438c-8bd3-f9523c0443f7
status: test
description: This rule flags registry writes that set the AppCompat compatibility layer value containing "REGISTERAPPRESTART" under the AppCompatFlags Layers path. Attackers can abuse this restart registration mechanism to maintain execution across reboots. The detection relies on registry set telemetry matching the target path and the presence of the "REGISTERAPPRESTART" string in the written details.
references:
  - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-01-01
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.011
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\
    Details|contains: REGISTERAPPRESTART
  condition: selection
falsepositives:
  - Legitimate applications making use of this feature for compatibility reasons
level: medium
license: DRL-1.1
related:
  - id: b86852fb-4c77-48f9-8519-eb1b2c308b59
    type: derived

What it detects

This rule flags registry writes that set the AppCompat compatibility layer value containing "REGISTERAPPRESTART" under the AppCompatFlags Layers path. Attackers can abuse this restart registration mechanism to maintain execution across reboots. The detection relies on registry set telemetry matching the target path and the presence of the "REGISTERAPPRESTART" string in the written details.

Known false positives

Legitimate applications making use of this feature for compatibility reasons

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.