Execution from Startup Folder (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may achieve persistence by adding a program to a startup folder. This use case looks for executions of processes that reside in those folders. NOTE, this use case will not identify the creation or execution of shortcuts(lnks) saved in the startup folder

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

References

https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '5997.18212'
title: Execution from Startup Folder
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder. This use case looks for executions of processes that reside in those folders.
  NOTE, this use case will not identify the creation or execution of shortcuts(lnks)
  saved in the startup folder. -- Threat Actor Association: APT29/Nobelium, Kimsuky,
  Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  UNC2465 - Software Association: Play, SmokedHAM, YellowCockatoo --'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  TERM(Startup) | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=1s | stats values(*) as * by _time, host | where match(parent_process_path,
  "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") OR match(process_path,
  "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") TERM(Startup)

Stage 2: `table`

| table _time, host, user process, process_*, signature_id, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(parent_process_path, "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") OR match(process_path, "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`parent_process_path`	regex_match	`"(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E"` corpus 2 (splunk 2)	`field:"parent_process_name" kind:regex_match`
`process_path`	regex_match	`"(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"EventCode=1"`
1	`"<EventID>1<"`
1	`Startup`