Windows Registry Persistence via AppCompatFlags Layers REGISTERAPPRESTART
Detects registry persistence settings that include the AppCompat layer "REGISTERAPPRESTART" on Windows.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry writes that set the AppCompat compatibility layer value containing "REGISTERAPPRESTART" under the AppCompatFlags Layers path. Attackers can abuse this restart registration mechanism to maintain execution across reboots. The detection relies on registry set telemetry matching the target path and the presence of the "REGISTERAPPRESTART" string in the written details.
Reporting behind it
- github.comhttps://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Persistence via AppCompatFlags Layers REGISTERAPPRESTART
id: 168a9c91-74b6-438c-8bd3-f9523c0443f7
status: test
description: This rule flags registry writes that set the AppCompat compatibility layer value containing "REGISTERAPPRESTART" under the AppCompatFlags Layers path. Attackers can abuse this restart registration mechanism to maintain execution across reboots. The detection relies on registry set telemetry matching the target path and the presence of the "REGISTERAPPRESTART" string in the written details.
references:
- https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-01-01
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.011
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\
Details|contains: REGISTERAPPRESTART
condition: selection
falsepositives:
- Legitimate applications making use of this feature for compatibility reasons
level: medium
license: DRL-1.1
related:
- id: b86852fb-4c77-48f9-8519-eb1b2c308b59
type: derived