Query: alert when Detects modification of autostart extensibility point (ASEP) in registry.
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentVersion NT Autorun Keys Modification id: cbf93e5d-ca6c-4722-8bea-e9119007c248 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_nt_current_version_base: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion selection_nt_current_version: TargetObject|contains: - \Winlogon\VmApplet - \Winlogon\Userinit - \Winlogon\Taskman - \Winlogon\Shell - \Winlogon\GpExtensions - \Winlogon\AppSetup - \Winlogon\AlternateShells\AvailableShells - \Windows\IconServiceLib - \Windows\Appinit_Dlls - \Image File Execution Options - \Font Drivers - \Drivers32 - \Windows\Run - \Windows\Load filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_main_legitimate_subkey: TargetObject|contains: \Image File Execution Options\ TargetObject|endswith: - \DisableExceptionChainValidation - \MitigationOptions filter_main_security_extension_dc: Image: C:\Windows\system32\svchost.exe TargetObject|contains: - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval Details: - DWORD (0x00000001) - DWORD (0x00000009) - DWORD (0x000003c0) filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost filter_optional_edge: Image|startswith: C:\Program Files (x86)\Microsoft\Temp\ Image|endswith: \MicrosoftEdgeUpdate.exe filter_optional_avguard: Image|startswith: - C:\Program Files (x86)\Avira\Antivirus\avguard.exe - C:\Program Files\Avira\Antivirus\avguard.exe TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentV
Near-miss passage: Sigma rule: Detects usage of winget to add new additional download sources. Logsource: windows / process_creation. Rule: title: Add New Download Source To Winget id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 related: - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: Detects usage of winget to add new additional download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' condition: all of selection_* falsepositives: - False positive are expected with legitimate sources level: medium