Potential Persistence Via MyComputer Registry Keys

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Known false positives

Unlikely but if you experience FPs add specific processes and locations you would like to monitor for

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Persistence Via MyComputer Registry Keys
id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
status: test
description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
references:
    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-09
modified: 2024-01-11
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
        TargetObject|endswith: '(Default)'
    condition: selection
falsepositives:
    - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
    TargetObject|endswith: '(Default)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`(Default)` corpus 2 (sigma 2)	`field:"TargetObject" kind:ends_with value:"(Default)"`
`TargetObject`	match	`\Microsoft\Windows\CurrentVersion\Explorer\MyComputer`	`field:"TargetObject" kind:match value:"\Microsoft\Windows\CurrentVersion\Explorer\MyComputer"`