Query: alert when Detects modification of autostart extensibility point (ASEP) in registry.
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node CurrentVersion Autorun Keys Modification id: b29aed60-ebd1-442b-9cb5-16a1d0324adb related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion selection_wow_current_version_keys: TargetObject|contains: - \ShellServiceObjectDelayLoad - \Run\ - \RunOnce\ - \RunOnceEx\ - \RunServices\ - \RunServicesOnce\ - \Explorer\ShellServiceObjects - \Explorer\ShellIconOverlayIdentifiers - \Explorer\ShellExecuteHooks - \Explorer\SharedTaskScheduler - \Explorer\Browser Helper Objects filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_ms_win_desktop_runtime: Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-' filter_main_vcredist: Image|endswith: \VC_redist.x64.exe Details|endswith: '}\VC_redist.x64.exe" /burn.runonce' filter_main_upgrades: Image|startswith: - C:\ProgramData\Package Cache - C:\Windows\Temp\ Image|contains: - \winsdksetup.exe - \windowsdesktop-runtime- - \AspNetCoreSharedFrameworkBundle- Details|endswith: ' /burn.runonce' filter_main_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: \Explorer\Browser Helper Objects filter_main_msiexec: Image: C:\WINDOWS\system32\msiexec.exe TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ filter_main_edge: Image|contains|all: - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ - \setup.exe filter_optional_msoffice1: Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow64
Near-miss passage: Sigma rule: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting. Logsource: zeek / kerberos. Rule: title: Kerberos Network Traffic RC4 Ticket Encryption id: 503fe26e-b5f2-4944-a126-eab405cc06e5 status: test description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting references: - https://adsecurity.org/?p=3458 author: sigma date: 2020-02-12 modified: 2021-11-27 tags: - attack.credential-access - attack.t1558.003 logsource: product: zeek service: kerberos detection: selection: request_type: TGS cipher: rc4-hmac computer_acct: service|startswith: $ condition: selection and not computer_acct falsepositives: - Normal enterprise SPN requests activity level: medium