Detection rules › Splunk
Wow6432Node Classes Autorun Keys Modification (Windows Event Log)
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level. This use case detects any modifications made to the \Software\Wow6432Node\Classes registry path, indicating modification of autostart extensibility point (ASEP).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4657 | A registry value was modified. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '32506.57765'
title: Wow6432Node Classes Autorun Keys Modification
description: Adversaries may achieve persistence by adding a program to a startup
folder or referencing it with a Registry run key. Adding an entry to the "run keys"
in the Registry or startup folder will cause the program referenced to be executed
when a user logs in. These programs will be executed under the context of the user
and will have the account's associated permissions level. This use case detects
any modifications made to the \Software\Wow6432Node\Classes registry path, indicating
modification of autostart extensibility point (ASEP).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
"<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
"ADD" OR "Set-ItemProperty" OR "sp " OR "New-ItemProperty" OR "New-Item" OR "md
" OR "ni ")) "SOFTWARE\\Wow6432Node\\Classes" ("\\Folder\\ShellEx\\ExtShellFolderViews"
OR "\\Folder\\ShellEx\\DragDropHandlers" OR "\\Folder\\ShellEx\\ColumnHandlers"
OR "\\Directory\\Shellex\\DragDropHandlers" OR "\\Directory\\Shellex\\CopyHookHandlers"
OR "\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance" OR "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance"
OR "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" OR "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance"
OR "\\AllFileSystemObjects\\ShellEx\\DragDropHandlers" OR "\\ShellEx\\PropertySheetHandlers"
OR "\\ShellEx\\ContextMenuHandlers") | table _time, host, user, process, process_*,
parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
folder
technique_id:
- T1547.001
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
- https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "ADD" OR "Set-ItemProperty" OR "sp " OR "New-ItemProperty" OR "New-Item" OR "md " OR "ni ")) "SOFTWARE\\Wow6432Node\\Classes" ("\\Folder\\ShellEx\\ExtShellFolderViews" OR "\\Folder\\ShellEx\\DragDropHandlers" OR "\\Folder\\ShellEx\\ColumnHandlers" OR "\\Directory\\Shellex\\DragDropHandlers" OR "\\Directory\\Shellex\\CopyHookHandlers" OR "\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance" OR "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance" OR "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" OR "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance" OR "\\AllFileSystemObjects\\ShellEx\\DragDropHandlers" OR "\\ShellEx\\PropertySheetHandlers" OR "\\ShellEx\\ContextMenuHandlers")
Stage 2: table
| table _time, host, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4657<" |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "ADD" |
| 1 | "Set-ItemProperty" |
| 1 | "sp " |
| 1 | "New-ItemProperty" |
| 1 | "New-Item" |
| 1 | "md " |
| 1 | "ni " |
| 1 | "SOFTWARE\\Wow6432Node\\Classes" |
| 1 | "\\Folder\\ShellEx\\ExtShellFolderViews" |
| 1 | "\\Folder\\ShellEx\\DragDropHandlers" |
| 1 | "\\Folder\\ShellEx\\ColumnHandlers" |
| 1 | "\\Directory\\Shellex\\DragDropHandlers" |
| 1 | "\\Directory\\Shellex\\CopyHookHandlers" |
| 1 | "\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance" |
| 1 | "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance" |
| 1 | "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" |
| 1 | "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance" |
| 1 | "\\AllFileSystemObjects\\ShellEx\\DragDropHandlers" |
| 1 | "\\ShellEx\\PropertySheetHandlers" |
| 1 | "\\ShellEx\\ContextMenuHandlers" |