Potential Persistence Via MyComputer Registry Keys

Hunt Hypothesis

Detects modification to the “Default” value of the “MyComputer” key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for

Detection Rule

Sigma (Original)

title: Potential Persistence Via MyComputer Registry Keys
id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
status: test
description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
references:
    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-09
modified: 2024-01-11
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
        TargetObject|endswith: '(Default)'
    condition: selection
falsepositives:
    - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high

KQL (Azure Sentinel)

imRegistry
| where RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer" and RegistryKey endswith "(Default)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer" and RegistryKey endswith "(Default)"

Required Data Sources

False Positive Guidance

• Unlikely but if you experience FPs add specific processes and locations you would like to monitor for

MITRE ATT&CK Context

• Tactic: Persistence

References

• https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
• SigmaHQ Rule