Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r

Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.

FreeUnreviewedSigmalowv1

windows-runonce-execution-via-runonce-exe-with-alternateshellstartup-and-r-198effb6

title: Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r
id: 0e5a29ff-378e-40b4-bb1d-24b1aaf6b344
status: test
description: This rule flags process creation of runonce.exe when it is invoked as the “Run Once Wrapper” with command-line parameters that include /AlternateShellStartup and /r. Such behavior matters because it can trigger attacker-controlled or persistence-oriented commands to run once during the system’s startup sequence or at a scheduled time. The detection relies on Windows process creation telemetry, matching the process image path, process description, and specific command-line argument patterns.
references:
  - https://twitter.com/pabraeken/status/990717080805789697
  - https://lolbas-project.github.io/lolbas/Binaries/Runonce/
  - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_runonce_execution.yml
author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated), Huntrule Team
date: 2020-10-18
modified: 2022-12-13
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \runonce.exe
    - Description: Run Once Wrapper
  selection_cli:
    - CommandLine|contains: /AlternateShellStartup
    - CommandLine|endswith: /r
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 198effb6-6c98-4d0c-9ea3-451fa143c45c
    type: derived

What it detects

This rule flags process creation of runonce.exe when it is invoked as the “Run Once Wrapper” with command-line parameters that include /AlternateShellStartup and /r. Such behavior matters because it can trigger attacker-controlled or persistence-oriented commands to run once during the system’s startup sequence or at a scheduled time. The detection relies on Windows process creation telemetry, matching the process image path, process description, and specific command-line argument patterns.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.