Common Autorun Keys Modification

Hunt Hypothesis

Detects modification of autostart extensibility point (ASEP) in registry.

Detection Rule

Sigma (Original)

title: Common Autorun Keys Modification
id: f59c3faf-50f3-464b-9f4c-1b67ab512d99
related:
    - id: 17f878b8-9968-4578-b814-c4217fc5768c
      type: obsolete
status: test
description: Detects modification of autostart extensibility point (ASEP) in registry.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
    - https://persistence-info.github.io/Data/userinitmprlogonscript.html # UserInitMprLogonScript
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)
date: 2019-10-25
modified: 2025-10-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services\AutoStart'
            - '\Software\Wow6432Node\Microsoft\Command Processor\Autorun'
            - '\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components'
            - '\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnDisconnect'
            - '\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect'
            - '\SYSTEM\Setup\CmdLine'
            - '\Software\Microsoft\Ctf\LangBarAddin'
            - '\Software\Microsoft\Command Processor\Autorun'
            - '\SOFTWARE\Microsoft\Active Setup\Installed Components'
            - '\SOFTWARE\Classes\Protocols\Handler'
            - '\SOFTWARE\Classes\Protocols\Filter'
            - '\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)'
            - '\Environment\UserInitMprLogonScript'
            - '\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\Scrnsave.exe'
            - '\Software\Microsoft\Internet Explorer\UrlSearchHooks'
            - '\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components'
            - '\Software\Classes\Clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Inprocserver32'
            - '\Control Panel\Desktop\Scrnsave.exe'
    filter_main_empty:
        Details: '(Empty)'
    filter_main_null:
        Details: null
    filter_main_poqexec:
        Image: 'C:\Windows\System32\poqexec.exe'
    filter_optional_msoffice:
        - TargetObject|contains:
              - '\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Handler\'
              - '\ClickToRunStore\HKMU\SOFTWARE\Classes\PROTOCOLS\Handler\'
        - Details:
              - '{314111c7-a502-11d2-bbca-00c04f8ec294}'
              - '{3459B272-CC19-4448-86C9-DDC3B4B2FAD3}'
              - '{42089D2D-912D-4018-9087-2B87803E93FB}'
              - '{5504BE45-A83B-4808-900A-3A5C36E7F77A}'
              - '{807583E5-5146-11D5-A672-00B0D022E945}'
    filter_optional_chrome:
        TargetObject|contains: '\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}'
    filter_optional_edge:
        TargetObject|contains: '\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}'
    filter_optional_IE:
        TargetObject|contains: '\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}'
    filter_optional_integrator:
        Image:
            - 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
            - 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
    filter_optional_office:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
    - Legitimate administrator sets up autorun keys for legitimate reason
level: medium

KQL (Azure Sentinel)

imRegistry
| where (RegistryKey contains "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows CE Services\\AutoStart" or RegistryKey contains "\\Software\\Wow6432Node\\Microsoft\\Command Processor\\Autorun" or RegistryKey contains "\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components" or RegistryKey contains "\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect" or RegistryKey contains "\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect" or RegistryKey contains "\\SYSTEM\\Setup\\CmdLine" or RegistryKey contains "\\Software\\Microsoft\\Ctf\\LangBarAddin" or RegistryKey contains "\\Software\\Microsoft\\Command Processor\\Autorun" or RegistryKey contains "\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components" or RegistryKey contains "\\SOFTWARE\\Classes\\Protocols\\Handler" or RegistryKey contains "\\SOFTWARE\\Classes\\Protocols\\Filter" or RegistryKey contains "\\SOFTWARE\\Classes\\Htmlfile\\Shell\\Open\\Command\\(Default)" or RegistryKey contains "\\Environment\\UserInitMprLogonScript" or RegistryKey contains "\\SOFTWARE\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\Scrnsave.exe" or RegistryKey contains "\\Software\\Microsoft\\Internet Explorer\\UrlSearchHooks" or RegistryKey contains "\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\Components" or RegistryKey contains "\\Software\\Classes\\Clsid\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Inprocserver32" or RegistryKey contains "\\Control Panel\\Desktop\\Scrnsave.exe") and (not((RegistryValueData =~ "(Empty)" or isnull(RegistryValueData) or ActingProcessName =~ "C:\\Windows\\System32\\poqexec.exe"))) and (not((((RegistryKey endswith "\\Office\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Classes\\PROTOCOLS\\Handler*" or RegistryKey endswith "\\ClickToRunStore\\HKMU\\SOFTWARE\\Classes\\PROTOCOLS\\Handler*") or (RegistryValueData in~ ("{314111c7-a502-11d2-bbca-00c04f8ec294}", "{3459B272-CC19-4448-86C9-DDC3B4B2FAD3}", "{42089D2D-912D-4018-9087-2B87803E93FB}", "{5504BE45-A83B-4808-900A-3A5C36E7F77A}", "{807583E5-5146-11D5-A672-00B0D022E945}"))) or RegistryKey contains "\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{8A69D345-D564-463c-AFF1-A69D9E530F96}" or RegistryKey contains "\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{9459C573-B17A-45AE-9F64-1857B5D58CEE}" or RegistryKey contains "\\Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11cf-8B85-00AA005B4383}" or (ActingProcessName in~ ("C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe", "C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe")) or ((ActingProcessName startswith "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\" or ActingProcessName startswith "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\") and ActingProcessName endswith "\\OfficeClickToRun.exe"))))

Required Data Sources

False Positive Guidance

• Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
• Legitimate administrator sets up autorun keys for legitimate reason

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Tactic: Persistence
• Technique: T1547.001 — T1547.001

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
• https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
• https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
• https://persistence-info.github.io/Data/userinitmprlogonscript.html
• SigmaHQ Rule