Potential Persistence Using DebugPath

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects potential persistence using Appx DebugPath

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.015` Event Triggered Execution: Component Object Model Hijacking
Privilege Escalation	`T1546.015` Event Triggered Execution: Component Object Model Hijacking

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Persistence Using DebugPath
id: df4dc653-1029-47ba-8231-3c44238cc0ae
status: test
description: Detects potential persistence using Appx DebugPath
references:
    - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
    - https://github.com/rootm0s/WinPwnage
author: frack113
date: 2022-07-27
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection_debug:
        TargetObject|contains: 'Classes\ActivatableClasses\Package\Microsoft.'
        TargetObject|endswith: '\DebugPath'
    selection_default:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.'
        TargetObject|endswith: '\(Default)'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_debug`

selection_debug:
    TargetObject|contains: 'Classes\ActivatableClasses\Package\Microsoft.'
    TargetObject|endswith: '\DebugPath'

Stage 2: `selection_default`

selection_default:
    TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.'
    TargetObject|endswith: '\(Default)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\(Default)` corpus 2 (sigma 2) `\DebugPath`	`field:"TargetObject" kind:ends_with`
`TargetObject`	match	`Classes\ActivatableClasses\Package\Microsoft.` `\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.`	`field:"TargetObject" kind:match`

Potential Persistence Using DebugPath

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_debug

Stage 2: selection_default

Indicators

Stage 0: `condition`

Stage 1: `selection_debug`

Stage 2: `selection_default`