Detection rules › Splunk
WinLogon Registry Key Modified (Sysmon)
Malicious modifications to specific registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence. This use case detects modifications to registry values affecting Winlogon behaviors that can be abused to achieve persistence
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL |
| Privilege Escalation | T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
Rule body yaml
id: '18431.31579'
title: WinLogon Registry Key Modified
description: 'Malicious modifications to specific registry keys may cause Winlogon
to load and execute malicious DLLs and/or executables. Adversaries may take advantage
of these features to repeatedly execute malicious code and establish persistence.
This use case detects modifications to registry values affecting Winlogon behaviors
that can be abused to achieve persistence. -- Software Association: Akira -- Atomics
T1547.004 Test #1 Atomics T1547.004 Test #2 Atomics T1547.004 Test #3 Atomics T1547.004
Test #4 Atomics T1547.004 Test #5 Atomics T1547.001 Test #14 Atomics T1547.001 Test
#15'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=12) OR "<EventID>12<"
OR TERM(EventCode=13) OR "<EventID>13<") "winlogon" | regex process="(?i)CurrentVersion\x5cWinlogon"
| table _time, host, user, parent_process*, process, process_*, signature_id, user_id
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:winlogon helper dll
- privilege-escalation:boot or logon autostart execution:winlogon helper dll
technique_id:
- T1547.004
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md#atomic-test-1---winlogon-shell-key-persistence---powershell
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=12) OR "<EventID>12<" OR TERM(EventCode=13) OR "<EventID>13<") "winlogon"
Stage 2: regex
| regex process="(?i)CurrentVersion\x5cWinlogon"
Stage 3: table
| table _time, host, user, parent_process*, process, process_*, signature_id, user_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>12<" |
| 1 | TERM |
| 1 | "<EventID>13<" |
| 1 | "winlogon" |