Session Manager Autorun Keys Modification

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source: github.com/SigmaHQ/sigma

Detects modification of autostart extensibility point (ASEP) in registry.

Known false positives

Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
Legitimate administrator sets up autorun keys for legitimate reason

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.009` Event Triggered Execution: AppCert DLLs `T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1546.009` Event Triggered Execution: AppCert DLLs `T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Session Manager Autorun Keys Modification
id: 046218bd-e0d8-4113-a3c3-895a12b2b298
related:
    - id: 17f878b8-9968-4578-b814-c4217fc5768c
      type: obsolete
status: test
description: Detects modification of autostart extensibility point (ASEP) in registry.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
date: 2019-10-25
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
    - attack.t1546.009
logsource:
    category: registry_set
    product: windows
detection:
    session_manager_base:
        TargetObject|contains: '\System\CurrentControlSet\Control\Session Manager'
    session_manager:
        TargetObject|contains:
            - '\SetupExecute'
            - '\S0InitialCommand'
            - '\KnownDlls'
            - '\Execute'
            - '\BootExecute'
            - '\AppCertDlls'
    filter:
        Details: '(Empty)'
    condition: session_manager_base and session_manager and not filter
falsepositives:
    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
    - Legitimate administrator sets up autorun keys for legitimate reason
level: medium

Stages and Predicates

Stage 0: `condition`

session_manager_base and session_manager and not filter

Stage 1: `session_manager_base`

session_manager_base:
    TargetObject|contains: '\System\CurrentControlSet\Control\Session Manager'

Stage 2: `session_manager`

session_manager:
    TargetObject|contains:
        - '\SetupExecute'
        - '\S0InitialCommand'
        - '\KnownDlls'
        - '\Execute'
        - '\BootExecute'
        - '\AppCertDlls'

Stage 3: `not filter`

filter:
    Details: '(Empty)'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	eq	`(Empty)`	`excludes:Details` `field:"Details" value:"(Empty)"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`\AppCertDlls` `\BootExecute` `\Execute` `\KnownDlls` `\S0InitialCommand` `\SetupExecute` `\System\CurrentControlSet\Control\Session Manager`	`field:"TargetObject" kind:match`

Session Manager Autorun Keys Modification

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: session_manager_base

Stage 2: session_manager

Stage 3: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `session_manager_base`

Stage 2: `session_manager`

Stage 3: `not filter`