Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit

title: Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit
id: f54cddfd-2c40-4280-80b2-7992ba4605d2
related:
  - id: c81fe886-cac0-4913-a511-2822d72ff505
    type: obsolete
  - id: 36803969-5421-41ec-b92f-8500f79c23b0
    type: derived
status: test
description: This rule identifies Windows registry persistence attempts by matching Image File Execution Options subkeys containing GlobalFlag and SilentProcessExit-related configuration values. Such behavior can be used to alter how processes start or fail in a way that reduces visibility to defenders. The detection relies on registry set telemetry, specifically TargetObject strings containing the expected key paths and value names.
references:
  - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_globalflags.yml
author: Karneades, Jonhnathan Ribeiro, Florian Roth, Huntrule Team
date: 2018-04-11
modified: 2023-06-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.012
  - car.2013-01-002
logsource:
  category: registry_set
  product: windows
detection:
  selection_global_flag:
    TargetObject|contains|all:
      - \Microsoft\Windows NT\CurrentVersion\
      - \Image File Execution Options\
      - \GlobalFlag
  selection_silent_process:
    TargetObject|contains|all:
      - \Microsoft\Windows NT\CurrentVersion\
      - \SilentProcessExit\
    TargetObject|contains:
      - \ReportingMode
      - \MonitorProcess
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1