Windows Registry Run Key Modification via winekey or team9 backdoor

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547Boot or Logon Autostart Execution
Priv Esc
- T1547Boot or Logon Autostart Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.

Reporting behind it

Related detections8 linkedT1547 — drag to rearrange

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

Windows: GPO Modification Adds Startup/Logon Script References

Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut

Windows grpconv Utility Execution with Output Option

Windows: Suspicious Driver Installation via pnputil.exe

Windows Registry Run Key Modification via winekey or team9 backdoor

Pivot detection · T1547 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-run-key-modification-via-winekey-or-team9-backdoor-b98968aa

title: Windows Registry Run Key Modification via winekey or team9 backdoor
id: fb5a3f42-d450-4bb1-83c8-731b04ccea20
status: test
description: This rule flags registry write events targeting the Windows Run key value "Backup Mgr" under Software\Microsoft\Windows\CurrentVersion\Run. Adversaries may use Run key modifications to establish persistence by launching malicious code at user logon. It relies on Windows registry event telemetry that records the TargetObject path for attempted or completed writes.
references:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml
author: omkar72, Huntrule Team
date: 2020-10-30
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL