huntrule

Windows Registry Run Key Modification via winekey or team9 backdoor

Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.

FreeUnreviewedSigmahighv1
title: Windows Registry Run Key Modification via winekey or team9 backdoor
id: fb5a3f42-d450-4bb1-83c8-731b04ccea20
status: test
description: This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.
references:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml
author: omkar72, Huntrule Team
date: 2020-10-30
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5
    type: derived

What it detects

This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.