{"id":"T1547.001","name":"Registry Run Keys / Startup Folder","url":"https://attack.mitre.org/techniques/T1547/001","tactics":["persistence","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0365","stix_id":"x-mitre-detection-strategy--8febbfe8-91ae-4625-8fc7-656639b90a11","name":"Detect Registry and Startup Folder Persistence (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0365","analytics":[{"id":"AN1032","stix_id":"x-mitre-analytic--e863e865-8ecc-47ce-b736-eec54b6399d6","name":"Analytic 1032","description":"Correlation of Registry key creation/modification events under known Run/Startup keys with new or unusual binary paths or script-based payloads. Multi-event detection includes registry modification followed by process execution from non-standard directories or abnormal parent-child process relationships.","url":"https://attack.mitre.org/detectionstrategies/DET0365#AN1032","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-Shell-Core","channel":"New startup folder shortcut or binary placed in Startup directory","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-microsoft-windows-shell-core"}],"mutable_elements":[{"field":"ImagePath","description":"Full path of the binary/script being registered in Run keys. Tunable to exclude known software baselines."},{"field":"RegistryKeyPath","description":"Tunable list of startup-related registry keys to monitor more/less aggressively based on enterprise software context."},{"field":"TimeWindow","description":"Correlate registry key creation and process execution within this window. Defaults between 5–10 minutes."},{"field":"UserContext","description":"Filter for specific user SIDs or exclude known admin/script accounts."}],"live":true,"detection_strategies":["DET0365"],"techniques":["T1547.001"]}],"live":true,"version":"1.0","techniques":["T1547.001"]}],"sigma_rules":[{"id":"02ee49e2-e294-4d0f-9278-f5b3212fc588","title":"New RUN Key Pointing to Suspicious Folder","author":"Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2018-08-25","modified":"2025-10-06","description":"Detects suspicious new RUN key element pointing to an executable in a suspicious folder","references":["https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml","techniques":["T1547.001"],"cves":[]},{"id":"046218bd-e0d8-4113-a3c3-895a12b2b298","title":"Session Manager Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","attack.t1546.009"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml","techniques":["T1547.001","T1546.009"],"cves":[]},{"id":"18f2065c-d36c-464a-a748-bcf909acb2e3","title":"Wow6432Node Classes Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml","techniques":["T1547.001"],"cves":[]},{"id":"1c2a3268-3881-414a-80af-a5b313b14c0e","title":"Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n","references":["https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0","https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1059.001","attack.t1027.010","attack.t1547.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml","techniques":["T1059.001","T1027.010","T1547.001"],"cves":[]},{"id":"20c3f09d-c53d-4e85-8b74-6aa50e2f1b61","title":"Suspicious VBScript UN2452 Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-05","modified":"2022-10-09","description":"Detects suspicious inline VBScript keywords as used by UNC2452","references":["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_vbscript_pattern.yml","techniques":["T1547.001"],"cves":[]},{"id":"20f0ee37-5942-4e45-b7d5-c5b5db9df5cd","title":"CurrentVersion Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d","https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml","techniques":["T1547.001"],"cves":[]},{"id":"24357373-078f-44ed-9ac4-6d334a668a11","title":"Direct Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2019-10-25","modified":"2026-01-05","description":"Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml","techniques":["T1547.001"],"cves":[]},{"id":"28208707-fe31-437f-9a7f-4b1108b94d2e","title":"Suspicious Startup Folder Persistence","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2022-08-10","modified":"2025-10-12","description":"Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors.\nThese files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers.\nThis technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.\n","references":["https://github.com/last-byte/PersistenceSniper","https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.execution","attack.t1204.002","attack.persistence","attack.t1547.001"],"path":"rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml","techniques":["T1204.002","T1547.001"],"cves":[]},{"id":"2aa0a6b4-a865-495b-ab51-c28249537b75","title":"Startup Folder File Write","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2025-12-03","description":"A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/12","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml","techniques":["T1547.001"],"cves":[]},{"id":"318557a5-150c-4c8d-b70e-a9910e199857","title":"File Creation In Suspicious Directory By Msdt.EXE","author":"Vadim Varganov, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-24","modified":"2023-02-23","description":"Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities","references":["https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd","https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","cve.2022-30190"],"path":"rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml","techniques":["T1547.001"],"cves":["CVE-2022-30190"]},{"id":"46490193-1b22-4c29-bdd6-5bf63907216f","title":"VBScript Payload Stored in Registry","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-05","modified":"2023-08-17","description":"Detects VBScript content stored into registry keys as seen being used by UNC2452 group","references":["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml","techniques":["T1547.001"],"cves":[]},{"id":"480421f9-417f-4d3b-9552-fd2728443ec8","title":"Wow6432Node Windows NT CurrentVersion Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml","techniques":["T1547.001"],"cves":[]},{"id":"5cdeb555-65de-4767-99fe-e26807465148","title":"Forest Blizzard APT - Custom Protocol Handler Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-04-23","modified":null,"description":"Detects the setting of a custom protocol handler with the name \"rogue\".\nSeen being created by Forest Blizzard APT as reported by MSFT.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler.yml","techniques":["T1547.001"],"cves":[]},{"id":"70d43542-cd2d-483c-8f30-f16b436fd7db","title":"Leviathan Registry Key Activity","author":"Aidan Bracher","status":"test","level":"critical","date":"2020-07-07","modified":"2023-09-19","description":"Detects registry key used by Leviathan APT in Malaysian focused campaign","references":["https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/Leviathan/registry_event_apt_leviathan.yml","techniques":["T1547.001"],"cves":[]},{"id":"74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc","title":"WinRAR Creating Files in Startup Locations","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-16","modified":null,"description":"Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder.\nThis kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.\n","references":["https://github.com/mulwareX/CVE-2025-6218-POC","https://x.com/0x534c/status/1944694507787710685","https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/file/file_event/file_event_win_winrar_file_creation_in_startup_folder.yml","techniques":["T1547.001"],"cves":[]},{"id":"8d85cf08-bf97-4260-ba49-986a2a65129c","title":"Suspicious PowerShell In Registry Run Keys","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-03-17","modified":"2025-07-18","description":"Detects potential PowerShell commands or code within registry run keys","references":["https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry","https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml","techniques":["T1547.001"],"cves":[]},{"id":"8f3ab69a-aa22-4943-aa58-e0a52fdf6818","title":"User Shell Folders Registry Modification via CommandLine","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-05","modified":null,"description":"Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.\nAttackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.\nThis technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.\n","references":["https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1547.001","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml","techniques":["T1547.001","T1112"],"cves":[]},{"id":"92fa78e7-4d39-45f1-91a3-8b23f3f1088d","title":"Potential Startup Shortcut Persistence Via PowerShell.EXE","author":"Christopher Peacock '@securepeacock', SCYTHE","status":"test","level":"high","date":"2021-10-24","modified":"2023-02-23","description":"Detects PowerShell writing startup shortcuts.\nThis procedure was highlighted in Red Canary Intel Insights Oct. 2021, \"We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.\nAccordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.\nIn the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL\"\n","references":["https://redcanary.com/blog/intelligence-insights-october-2021/","https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml","techniques":["T1547.001"],"cves":[]},{"id":"9c226817-8dc9-46c2-a58d-66655aafd7dc","title":"Modify User Shell Folders Startup Value","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2022-10-01","modified":"2026-01-05","description":"Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.\nAttackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.\nThis technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md","https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml","techniques":["T1547.001"],"cves":[]},{"id":"9c5037d1-c568-49b3-88c7-9846a5bdc2be","title":"Suspicious Run Key from Download","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)","status":"test","level":"high","date":"2019-10-01","modified":"2025-02-17","description":"Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories","references":["https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml","techniques":["T1547.001"],"cves":[]},{"id":"9df5f547-c86a-433e-b533-f2794357e242","title":"Classes Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","description":"Detects modification of Windows Registry Classes keys used for persistence.\nAdversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.\nVarious legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,\nthus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml","techniques":["T1547.001"],"cves":[]},{"id":"a80f662f-022f-4429-9b8c-b1a41aaa6688","title":"Internet Explorer Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml","techniques":["T1547.001"],"cves":[]},{"id":"b29aed60-ebd1-442b-9cb5-16a1d0324adb","title":"Wow6432Node CurrentVersion Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-12-08","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d","https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml","techniques":["T1547.001"],"cves":[]},{"id":"b7916c2a-fa2f-4795-9477-32b731f70f11","title":"Registry Persistence via Explorer Run Key","author":"Florian Roth (Nextron Systems), oscd.community","status":"test","level":"high","date":"2018-07-18","modified":"2023-12-11","description":"Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder","references":["https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml","techniques":["T1547.001"],"cves":[]},{"id":"ba226dcf-d390-4642-b9af-b534872f1156","title":"Windows Event Log Access Tampering Via Registry","author":"X__Junior","status":"experimental","level":"high","date":"2025-01-16","modified":"2025-08-16","description":"Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as \"Get-EventLog\" or \"wevtutil\".\n","references":["https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell","https://www.youtube.com/watch?v=uSYvHUVU8xY","https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.defense-impairment","attack.t1547.001","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml","techniques":["T1547.001","T1112"],"cves":[]},{"id":"baecf8fb-edbf-429f-9ade-31fc3f22b970","title":"Office Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2026-01-09","description":"Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.\nThere are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.\nThus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml","techniques":["T1547.001"],"cves":[]},{"id":"c0c67b21-eb8a-4c84-a395-40473ec3b482","title":"Kapeka Backdoor Autorun Persistence","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-07-03","modified":null,"description":"Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.","references":["https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml","techniques":["T1547.001"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]},{"id":"c37510b8-2107-4b78-aa32-72f251e7a844","title":"Potential Ryuk Ransomware Activity","author":"Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"high","date":"2019-12-16","modified":"2023-02-03","description":"Detects Ryuk ransomware activity","references":["https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/","https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml","techniques":["T1547.001"],"cves":[]},{"id":"c80e66d8-1780-48a9-b412-46663fd21ac0","title":"Suspicious Autorun Registry Modified via WMI","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-17","modified":null,"description":"Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.\n","references":["Internal Research","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1547.001","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_autorun_registry_modified_via_wmic.yml","techniques":["T1547.001","T1047"],"cves":[]},{"id":"c9b86500-1ec2-4de6-9120-d744c8fb5caf","title":"Potential KamiKakaBot Activity - Winlogon Shell Persistence","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior","status":"test","level":"high","date":"2024-03-22","modified":null,"description":"Detects changes to the \"Winlogon\" registry key where a process will set the value of the \"Shell\" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.\n","references":["https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/KamiKakaBot/registry_set_malware_kamikakabot_winlogon_persistence.yml","techniques":["T1547.001"],"cves":[]},{"id":"cbf93e5d-ca6c-4722-8bea-e9119007c248","title":"CurrentVersion NT Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml","techniques":["T1547.001"],"cves":[]},{"id":"d6c2ce7e-afb5-4337-9ca4-4b5254ed0565","title":"WinSock2 Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml","techniques":["T1547.001"],"cves":[]},{"id":"d807056b-0e00-4cec-b7f8-b8b7518e382b","title":"Forest Blizzard APT - Custom Protocol Handler DLL Registry Set","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-04-23","modified":null,"description":"Detects the setting of the DLL that handles the custom protocol handler.\nSeen being created by Forest Blizzard APT as reported by MSFT.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml","techniques":["T1547.001"],"cves":[]},{"id":"de587dce-915e-4218-aac4-835ca6af6f70","title":"Potential Persistence Attempt Via Run Keys Using Reg.EXE","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-06-28","modified":"2025-02-17","description":"Detects suspicious command line reg.exe tool adding key to RUN key in Registry","references":["https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/","https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/process_creation/proc_creation_win_reg_add_run_key.yml","techniques":["T1547.001"],"cves":[]},{"id":"e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1","title":"System Scripts Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml","techniques":["T1547.001"],"cves":[]},{"id":"f59c3faf-50f3-464b-9f4c-1b67ab512d99","title":"Common Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d","https://persistence-info.github.io/Data/userinitmprlogonscript.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml","techniques":["T1547.001"],"cves":[]},{"id":"f663a6d9-9d1b-49b8-b2b1-0637914d199a","title":"Narrator's Feedback-Hub Persistence","author":"Dmitriy Lifanov, oscd.community","status":"test","level":"high","date":"2019-10-25","modified":"2022-03-26","description":"Detects abusing Windows 10 Narrator's Feedback-Hub","references":["https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml","techniques":["T1547.001"],"cves":[]},{"id":"f674e36a-4b91-431e-8aef-f8a96c2aca35","title":"CurrentControlSet Autorun Keys Modification","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2023-08-17","description":"Detects modification of autostart extensibility point (ASEP) in registry.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml","techniques":["T1547.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2022-22047","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}