Windows Registry Run Key Modification via winekey or team9 backdoor
Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_event
- Author
- omkar72 (SigmaHQ), DRL 1.1
- Published
- 2020-10-30
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-run-key-modification-via-winekey-or-team9-backdoor-b98968aa
title: Windows Registry Run Key Modification via winekey or team9 backdoor
id: fb5a3f42-d450-4bb1-83c8-731b04ccea20
status: test
description: This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml
author: omkar72, Huntrule Team
date: 2020-10-30
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5
type: derived