Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification
Alerts on registry modifications to Wow6432Node NT CurrentVersion autorun-related keys tied to persistence behavior.
- Product
- windows
- Category
- registry_set
- Author
- Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry writes targeting the 32-bit compatibility hive under SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion and specifically keys associated with autostart extensibility. Such changes can enable persistence by redirecting or loading attacker-controlled components at startup or process execution time. It relies on registry_set telemetry that includes TargetObject and Details fields, while excluding empty and null Details values and filtering out entries ending with the Image File Execution Options path.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- gist.github.comhttps://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification"
id: 927320f6-165c-4b17-ab78-1ba4aff6e1f2
related:
- id: 17f878b8-9968-4578-b814-c4217fc5768c
type: obsolete
- id: 480421f9-417f-4d3b-9552-fd2728443ec8
type: derived
status: test
description: This rule flags registry writes targeting the 32-bit compatibility hive under SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion and specifically keys associated with autostart extensibility. Such changes can enable persistence by redirecting or loading attacker-controlled components at startup or process execution time. It relies on registry_set telemetry that includes TargetObject and Details fields, while excluding empty and null Details values and filtering out entries ending with the Image File Execution Options path.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection_wow_nt_current_version_base:
TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion
selection_wow_nt_current_version:
TargetObject|contains:
- \Windows\Appinit_Dlls
- \Image File Execution Options
- \Drivers32
filter_main_empty:
Details: (Empty)
filter_main_null:
Details: null
filter_main_file_exec_options:
Details|endswith: \Microsoft\Windows NT\CurrentVersion\Image File Execution Options
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1