Sigma rule: CurrentControlSet Autorun Keys Modification

Rule

Title

CurrentControlSet Autorun Keys Modification

Status

test

Level

medium

Author

Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)

Date

2019-10-25

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects modification of autostart extensibility point (ASEP) in registry.

Log source

product

windows

category

registry_set

Detection

system_control_base:
    TargetObject|contains: '\SYSTEM\CurrentControlSet\Control'
system_control_keys:
    TargetObject|contains:
        - '\Terminal Server\WinStations\RDP-Tcp\InitialProgram'
        - '\Terminal Server\Wds\rdpwd\StartupPrograms'
        - '\SecurityProviders\SecurityProviders'
        - '\SafeBoot\AlternateShell'
        - '\Print\Providers'
        - '\Print\Monitors'
        - '\NetworkProvider\Order'
        - '\Lsa\Notification Packages'
        - '\Lsa\Authentication Packages'
        - '\BootVerificationProgram\ImagePath'
filter_empty:
    Details: '(Empty)'
filter_cutepdf:
    Image: 'C:\Windows\System32\spoolsv.exe'
    TargetObject|contains: '\Print\Monitors\CutePDF Writer Monitor'
    Details:
        - 'cpwmon64_v40.dll'
        - 'CutePDF Writer'
filter_onenote:
    Image: C:\Windows\System32\spoolsv.exe
    TargetObject|contains: 'Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_'
    User|contains: # covers many language settings
        - 'AUTHORI'
        - 'AUTORI'
filter_poqexec:
    Image: 'C:\Windows\System32\poqexec.exe'
    TargetObject|endswith: '\NetworkProvider\Order\ProviderOrder'
filter_realvnc:
    Image: 'C:\Windows\System32\spoolsv.exe'
    TargetObject|endswith: '\Print\Monitors\MONVNC\Driver'
    Details: 'VNCpm.dll'
condition: all of system_control_* and not 1 of filter_*

False positives (as the rule lists them)

• Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
• Legitimate administrator sets up autorun keys for legitimate reason

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

Related rules

• 17f878b8-9968-4578-b814-c4217fc5768c (obsolete)

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
• https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
• https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml