Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification

Alerts on registry modifications to Wow6432Node NT CurrentVersion autorun-related keys tied to persistence behavior.

FreeUnreviewedSigmamediumv1

windows-registry-wow6432node-nt-currentversion-autorun-keys-modification-480421f9

title: "Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification"
id: 927320f6-165c-4b17-ab78-1ba4aff6e1f2
related:
  - id: 17f878b8-9968-4578-b814-c4217fc5768c
    type: obsolete
  - id: 480421f9-417f-4d3b-9552-fd2728443ec8
    type: derived
status: test
description: This rule flags registry writes targeting the 32-bit compatibility hive under SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion and specifically keys associated with autostart extensibility. Such changes can enable persistence by redirecting or loading attacker-controlled components at startup or process execution time. It relies on registry_set telemetry that includes TargetObject and Details fields, while excluding empty and null Details values and filtering out entries ending with the Image File Execution Options path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_wow_nt_current_version_base:
    TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion
  selection_wow_nt_current_version:
    TargetObject|contains:
      - \Windows\Appinit_Dlls
      - \Image File Execution Options
      - \Drivers32
  filter_main_empty:
    Details: (Empty)
  filter_main_null:
    Details: null
  filter_main_file_exec_options:
    Details|endswith: \Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
  - Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1

What it detects

This rule flags registry writes targeting the 32-bit compatibility hive under SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion and specifically keys associated with autostart extensibility. Such changes can enable persistence by redirecting or loading attacker-controlled components at startup or process execution time. It relies on registry_set telemetry that includes TargetObject and Details fields, while excluding empty and null Details values and filtering out entries ending with the Image File Execution Options path.

Known false positives

Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
Legitimate administrator sets up autorun keys for legitimate reason

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.