kevmap

Techniques › T1547 › T1547.010

T1547.010 Port Monitors

persistence · privilege escalation — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1547.010
0
KEV CVEs mapped here
<p>Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup. This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.</p><p>Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the Driver value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following:</p>
    <li>Local Port</li><li>Standard TCP/IP Port</li><li>USB Monitor</li><li>WSD Port</li>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.010

Default RDP Port Changed to Non Standard Port hightest
Author: frack113 · 2022-01-01 (modified 2024-03-25) · logsource: product=windows category=registry_set · 509e84b9-a71a-40e0-834f-05470369bd1e
Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Techniques: T1547.010
Bypass UAC Using Event Viewer hightest
Author: frack113 · 2022-01-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 674202d0-b22a-4af4-ae5f-2eda1f3da1af
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Techniques: T1547.010
Add Port Monitor Persistence in Registry mediumtest
Author: frack113 · 2021-12-30 (modified 2024-03-25) · logsource: product=windows category=registry_set · 944e8941-f6f6-4ee8-ac05-1c224e923c0e
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Techniques: T1547.010
Potential Suspicious Activity Using SeCEdit mediumtest
Author: Janantha Marasinghe · 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Techniques: T1685.001T1547.001T1505.005T1556.002T1685T1574.007T1564.002T1546.008T1546.007T1547.014T1547.010T1547.002T1557T1082

Rules tagged at the parent level (attack.t1547) 7

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Startup/Logon Script Added to Group Policy Object mediumtest
Author: Elastic, Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Techniques: T1484.001T1547
Registry Persistence Mechanisms in Recycle Bin hightest
Author: frack113 · 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167
Detects persistence registry keys for Recycle Bin
Techniques: T1547
Atbroker Registry Change mediumtest
Author: Mateusz Wydra, oscd.community · 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Techniques: T1218T1547
Suspicious Driver Install by pnputil.exe mediumtest
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger · 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Techniques: T1547
Potential RipZip Attack on Startup Folder hightest
Author: Greg (rule) · 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Techniques: T1547
WINEKEY Registry Modification hightest
Author: omkar72 · 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5
Detects potential malicious modification of run keys by winekey or team9 backdoor
Techniques: T1547
Suspicious GrpConv Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
Techniques: T1547