Query: alert when This rule detects the execution of Run Once task as configured in the registry
Matching passage: Sigma rule: This rule detects the execution of Run Once task as configured in the registry. Logsource: windows / process_creation. Rule: title: Run Once Task Execution as Configured in Registry id: 198effb6-6c98-4d0c-9ea3-451fa143c45c status: test description: This rule detects the execution of Run Once task as configured in the registry references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) date: 2020-10-18 modified: 2022-12-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \runonce.exe - Description: Run Once Wrapper selection_cli: - CommandLine|contains: /AlternateShellStartup - CommandLine|endswith: /r condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may. Logsource: windows / process_creation. Rule: title: Script Interpreter Execution From Suspicious Folder id: 1228c958-e64e-4e71-92ad-7d429f4138ba status: test description: 'Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts. ' references: - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - https://learn.microsoft.com/en-us/windows/win32/shell/csidl author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-08 modified: 2026-02-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_proc_image: Image|endswith: - \cscript.exe - \mshta.exe - \wscript.exe selection_proc_flags: CommandLine|contains: - ' -ep bypass ' - ' -ExecutionPolicy bypass ' - ' -w hidden ' - '/e:javascript ' - '/e:Jscript ' - '/e:vbscript ' selection_proc_original: OriginalFileName: - cscript.exe - mshta.exe - wscript.exe selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \%Public% - \AppData\Local\Temp - \AppData\Roaming\Temp - \Temporary Internet - \Windows\Temp - \Start Menu\Programs\Startup\ - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Documents\ - CommandLine|contains|all: - :\Users\ - \Music\ - CommandLine|contains|all: - :\Users\ - \Pictures\ - CommandLine|contains|all: - :\Users\ - \Videos\ filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environme