Windows Registry: Wow6432Node CurrentVersion Autorun Key Modification
Flags registry writes to Wow6432Node\...\CurrentVersion autostart and Explorer persistence locations, excluding common benign installer activity.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry changes under Wow6432Node\Microsoft\Windows\CurrentVersion that affect common autostart and extensibility points, including Run/RunOnce, RunServices, and several Explorer shell-related registration areas. Such modifications can enable persistence by causing code to run at user logon or system events. It relies on registry set telemetry capturing the affected TargetObject and the process Image context, then applies multiple suppressions to reduce known benign installer and application update activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- gist.github.comhttps://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- oddvar.moehttps://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-wow6432node-currentversion-autorun-key-modification-b29aed60
title: "Windows Registry: Wow6432Node CurrentVersion Autorun Key Modification"
id: 49936650-e302-44cb-9572-86cf1e458013
related:
- id: 17f878b8-9968-4578-b814-c4217fc5768c
type: obsolete
- id: b29aed60-ebd1-442b-9cb5-16a1d0324adb
type: derived
status: test
description: This rule identifies registry changes under Wow6432Node\Microsoft\Windows\CurrentVersion that affect common autostart and extensibility points, including Run/RunOnce, RunServices, and several Explorer shell-related registration areas. Such modifications can enable persistence by causing code to run at user logon or system events. It relies on registry set telemetry capturing the affected TargetObject and the process Image context, then applies multiple suppressions to reduce known benign installer and application update activity.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-12-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection_wow_current_version_base:
TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion
selection_wow_current_version_keys:
TargetObject|contains:
- \ShellServiceObjectDelayLoad
- \Run\
- \RunOnce\
- \RunOnceEx\
- \RunServices\
- \RunServicesOnce\
- \Explorer\ShellServiceObjects
- \Explorer\ShellIconOverlayIdentifiers
- \Explorer\ShellExecuteHooks
- \Explorer\SharedTaskScheduler
- \Explorer\Browser Helper Objects
filter_main_empty:
Details: (Empty)
filter_main_null:
Details: null
filter_main_ms_win_desktop_runtime:
Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-'
filter_main_vcredist:
Image|endswith: \VC_redist.x64.exe
Details|endswith: '}\VC_redist.x64.exe" /burn.runonce'
filter_main_upgrades:
Image|startswith:
- C:\ProgramData\Package Cache
- C:\Windows\Temp\
Image|contains:
- \winsdksetup.exe
- \windowsdesktop-runtime-
- \AspNetCoreSharedFrameworkBundle-
Details|endswith: " /burn.runonce"
filter_main_uninstallers:
Image|startswith: C:\Windows\Installer\MSI
TargetObject|contains: \Explorer\Browser Helper Objects
filter_main_msiexec:
Image: C:\WINDOWS\system32\msiexec.exe
TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\
filter_main_edge:
Image|contains|all:
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{
- \setup.exe
filter_optional_msoffice1:
Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\
filter_optional_msoffice2:
Image:
- C:\Program Files\Microsoft Office\root\integration\integrator.exe
- C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
TargetObject|contains: \Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\
filter_optional_dropbox:
- Details|endswith: -A251-47B7-93E1-CDD82E34AF8B}
- Details: grpconv -o
- Details|contains|all:
- C:\Program Files
- \Dropbox\Client\Dropbox.exe
- " /systemstartup"
filter_optional_evernote:
TargetObject|endswith: \Explorer\Browser Helper Objects\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}\NoExplorer
filter_optional_dotnet:
Image|contains: \windowsdesktop-runtime-
TargetObject|endswith:
- \WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e2d1ae32-dd1d-4ad7-a298-10e42e7840fc}
- \WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7037b699-7382-448c-89a7-4765961d2537}
Details|startswith: '"C:\ProgramData\Package Cache\'
Details|endswith: .exe" /burn.runonce
filter_optional_office:
Image|startswith:
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\
Image|endswith: \OfficeClickToRun.exe
filter_optional_discord:
TargetObject|endswith: \SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Discord
Details|endswith: Discord.exe --checkInstall
filter_optional_avira:
Details|endswith: \Avira.OE.Setup.Bundle.exe" /burn.runonce
Image|endswith: \Avira.OE.Setup.Bundle.exe
filter_optional_avg_1:
Image|endswith: \instup.exe
TargetObject|endswith: \SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair
Details|endswith: instup.exe" /instop:repair /wait
filter_optional_avg_2:
Image|endswith: \instup.exe
TargetObject|endswith:
- \SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg\(Default)
- \SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw\(Default)
Details:
- "{472083B1-C522-11CF-8763-00608CC02F24}"
- "{472083B0-C522-11CF-8763-00608CC02F24}"
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1