Query: detect Detects modification of autostart extensibility point (ASEP) in registry. in logs
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification id: 480421f9-417f-4d3b-9552-fd2728443ec8 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_nt_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion selection_wow_nt_current_version: TargetObject|contains: - \Windows\Appinit_Dlls - \Image File Execution Options - \Drivers32 filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_file_exec_options: Details|endswith: \Microsoft\Windows NT\CurrentVersion\Image File Execution Options condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" fla. Logsource: windows / process_creation. Rule: title: Change PowerShell Policies to an Insecure Level id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ author: frack113 date: 2021-11-01 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe selection_option: CommandLine|contains: - '-executionpolicy ' - ' -ep ' - ' -exec ' selection_level: CommandLine|contains: - Bypass - Unrestricted filter_main_powershell_core: ParentImage: - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\msiexec.exe CommandLine|contains: - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\PowerShell\7\ - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files (x86)\PowerShell\7\ filter_optional_avast: ParentImage|contains: - C:\Program Files\Avast Software\Avast\ - C:\Program Files (x86)\Avast Software\Avast\ - \instup.exe CommandLine|contains: - -ExecutionPolicy ByPass -File "C:\Program Files\Avast Software\Avast - -ExecutionPolicy ByPass -File "C:\Program Files (x86)\Avast Software\Avast\ condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrator scripts level: medium