Skip to content

Commit e033410

Browse files
jorik-utwentejorik-utwente
authoredDec 9, 2024··
Add 38 new registry-based persistence techniques (#954)
* Add 38 new registry-based persistence techniques * fix hhctrl com hijack match statement * fix core_profiler_path rule * remove optional from disk cleanup handler rule * update dotnet_startup_hooks * improve filter handler rule * update persist via PATH * merge task schedule persistence with existing rule * update UserInitMprLogonScript rule * merge universal app uri with default file association; add better reference
·
v9.1.0v8.0.0
1 parent ce5e041 commit e033410

File tree

37 files changed

+702
-7
lines changed

37 files changed

+702
-7
lines changed
 

‎nursery/persist-via-aedebug-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via AeDebug registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows NT\\CurrentVersion\\AeDebug/i
18+
- string: /Debugger/i

‎nursery/persist-via-amsi-registry-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via AMSI registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\AMSI\\Providers\\/i

‎nursery/persist-via-app-paths-registry-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via App paths registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow::Path Interception by PATH Environment Variable [T1574.007]
12+
references:
13+
- https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows\\CurrentVersion\\App Paths\\/i

‎nursery/persist-via-appcertdlls-registry-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via AppCertDlls registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution::AppCert DLLs [T1546.009]
12+
references:
13+
- https://skanthak.hier-im-netz.de/appcert.html
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /System\\(CurrentControlSet|ControlSet001)\\Control\\Session Manager\\AppCertDlls/i

‎nursery/persist-via-appx-registry-key.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule:
2+
meta:
3+
name: persist via AppX registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- string: /Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\/i
19+
- and:
20+
- string: /ActivatableClasses\\Package\\/i
21+
- string: /DebugInformation/i
22+
- string: /DebugPath/i

‎nursery/persist-via-autodialdll-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via AutodialDLL registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/windows/win32/rras/autodial-connection-operations
14+
- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /System\\(CurrentControlSet|ControlSet001)\\Services\\WinSock2\\Parameters/i
19+
- string: /AutodialDLL/i

‎nursery/persist-via-autoplayhandlers-registry-key.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule:
2+
meta:
3+
name: persist via AutoplayHandlers registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/windows/win32/shell/how-to-register-a-handler-for-a-device-event
14+
- https://www.hexacorn.com/blog/2019/09/07/beyond-good-ol-run-key-part-114/
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoplayHandlers\\Handlers\\/i
19+
- or:
20+
- string: /Action/i
21+
- string: /Provider/i
22+
- string: /InitCmd/i

‎nursery/persist-via-bootverificationprogram-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via BootVerificationProgram registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution [T1547]
12+
references:
13+
- https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /System\\(CurrentControlSet|ControlSet001)\\Control\\BootVerificationProgram/i
18+
- string: /ImagePath/i

‎nursery/persist-via-code-signing-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via Code signing registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://specterops.io/wp-content/uploads/sites/3/2022/06/SpecterOps_Subverting_Trust_in_Windows.pdf
14+
features:
15+
- and:
16+
- match: set registry value
17+
- and:
18+
- string: /Microsoft\\Cryptography\\OID\\/i
19+
- string: /^Dll$/i

‎nursery/persist-via-com-hijack.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
rule:
2+
meta:
3+
name: persist via COM hijack
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution::Component Object Model Hijacking [T1546.015]
12+
references:
13+
- https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-2-com-hijacking/
14+
- https://stmxcsr.com/persistence/com-hijacking.html
15+
features:
16+
- and:
17+
- match: set registry value
18+
- or:
19+
- string: /Classes\\CLSID/i
20+
- string: /Classes\\WOW6432Node\\CLSID/i
21+
- or:
22+
- string: /InProcServer32/i
23+
- string: /LocalServer32/i

‎nursery/persist-via-command-processor-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via Command Processor registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433
14+
features:
15+
- and:
16+
- match: set registry value
17+
- and:
18+
- string: /Microsoft\\Command Processor/i
19+
- string: /AutoRun/i

‎nursery/persist-via-contextmenuhandlers-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via ContextMenuHandlers registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://pentestlab.blog/2023/03/13/persistence-context-menu/
14+
- https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /\\shellex\\ContextMenuHandlers\\/i

‎nursery/persist-via-cor_profiler_path-registry-value.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via COR_PROFILER_PATH registry value
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow::COR_PROFILER [T1574.012]
12+
references:
13+
- https://redcanary.com/blog/threat-detection/cor_profiler-for-persistence/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Environment/i
18+
- string: /COR_PROFILER_PATH/i

‎nursery/persist-via-default-file-association-registry-key.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule:
2+
meta:
3+
name: persist via default file association registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution::Change Default File Association [T1546.001]
12+
references:
13+
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/default-file-association
14+
- https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
15+
features:
16+
- and:
17+
- match: set registry value
18+
- or:
19+
- string: /\\shell\\open\\command/i
20+
- string: /\\shell\\print\\command/i
21+
- string: /\\shell\\printto\\command/i

‎nursery/persist-via-disk-cleanup-handler-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via Disk Cleanup Handler registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
14+
- https://learn.microsoft.com/en-us/windows/win32/lwef/disk-cleanup
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\/i

‎nursery/persist-via-dotnet-dbgmanageddebugger-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via .NET DbgManagedDebugger registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2022
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\.NETFramework/i
18+
- string: /DbgManagedDebugger/i

‎nursery/persist-via-dotnet_startup_hooks-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via DOTNET_STARTUP_HOOKS registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow::DLL Side-Loading [T1574.002]
12+
references:
13+
- https://github.com/dotnet/runtime/blob/main/docs/design/features/host-startup-hook.md
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Environment/i
18+
- string: /DOTNET_STARTUP_HOOKS/i

‎nursery/persist-via-explorer-tools-registry-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via Explorer tools registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\/i

‎nursery/persist-via-filter-handlers-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via Filter Handlers registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://learn.microsoft.com/en-us/windows/win32/search/-search-ifilter-about
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- string: /\\\..*\\PersistentHandler/i
19+
- string: /CLSID\\.*\\PersistentHandler/i

‎nursery/persist-via-group-policy-registry-key.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule:
2+
meta:
3+
name: persist via Group Policy registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution [T1547]
12+
references:
13+
- None
14+
features:
15+
- and:
16+
- match: set registry value
17+
- and:
18+
- or:
19+
- string: /Microsoft\\Windows\\CurrentVersion\\Group Policy\\Scripts\\Startup\\.*?\\.*/i
20+
- string: /Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine\\Scripts\\.*?\\.*/i
21+
- string: /^Script$/i

‎nursery/persist-via-hhctrl-com-hijack.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via hhctrl COM hijack
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow [T1574]
12+
references:
13+
- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
14+
features:
15+
- and:
16+
- match: persist via COM hijack
17+
- string: /{52A2AAAE-085D-4187-97EA-8C30DB990436}/i

‎nursery/persist-via-htmlhelp-author-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via HtmlHelp Author registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow [T1574]
12+
references:
13+
- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- and:
18+
- string: /Software\\Microsoft\\HtmlHelp Author/i
19+
- string: /location/i

‎nursery/persist-via-image-file-execution-options-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via Image File Execution Options registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution::Image File Execution Options Injection [T1546.012]
12+
references:
13+
- https://www.malwarebytes.com/blog/101/2015/12/an-introduction-to-image-file-execution-options
14+
- https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\/i
19+
- string: /Debugger/i

‎nursery/persist-via-lsa-registry-key.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
rule:
2+
meta:
3+
name: persist via LSA registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution::Authentication Package [T1547.002]
12+
- Persistence::Boot or Logon Autostart Execution::Security Support Provider [T1547.005]
13+
references:
14+
- https://learn.microsoft.com/en-us/windows/win32/secauthn/authentication-packages
15+
- https://learn.microsoft.com/en-us/windows/win32/secmgmt/password-filters
16+
features:
17+
- and:
18+
- match: set registry value
19+
- or:
20+
- and:
21+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\Lsa/i
22+
- or:
23+
- string: /Authentication Packages/i
24+
- string: /Notification packages/i
25+
- string: /Security Packages/i
26+
- and:
27+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\LsaExtensionConfig\\LsaSrv/i
28+
- string: /Extensions/i

‎nursery/persist-via-natural-language-registry-key.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule:
2+
meta:
3+
name: persist via Natural Language registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution [T1547]
12+
references:
13+
- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\ContentIndex\\Language\\/i
18+
- or:
19+
- string: /StemmerDLLPathOverride/i
20+
- string: /WBDLLPathOverride/i

‎nursery/persist-via-netsh-registry-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule:
2+
meta:
3+
name: persist via Netsh registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Netsh/i

‎nursery/persist-via-network-provider-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via Network provider registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Modify Authentication Process::Network Provider DLL [T1556.008]
12+
references:
13+
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Services\\.*\\NetworkProvider/i
18+
- string: /ProviderPath/i

‎nursery/persist-via-path-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via PATH registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Hijack Execution Flow::Path Interception by PATH Environment Variable [T1574.007]
12+
references:
13+
- https://attack.mitre.org/techniques/T1574/007/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Environment/i
18+
- string: /^PATH$/i

‎nursery/persist-via-print-monitors-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via Print Monitors registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution::Port Monitors [T1547.010]
12+
references:
13+
- https://stmxcsr.com/persistence/print-monitor.html
14+
- https://learn.microsoft.com/en-us/windows/win32/printdocs/addmonitor
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\Print\\Monitors\\/i
19+
- string: /^Driver$/i

‎nursery/persist-via-rdp-startup-programs-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via RDP startup programs registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://www.cyberark.com/resources/threat-research-blog/attacking-rdp-from-inside
14+
- https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\Terminal Server\\Wds\\rdpwd/i
19+
- string: /^StartupPrograms$/i

‎nursery/persist-via-silentprocessexit-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via SilentProcessExit registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\.*/i
18+
- string: /^MonitorProcess$/i

‎nursery/persist-via-telemetrycontroller-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via TelemetryController registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Scheduled Task/Job [T1053]
12+
references:
13+
- https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\/i
18+
- string: /^Command$/i

‎nursery/persist-via-timeproviders-registry-key.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: persist via TimeProviders registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Autostart Execution::Time Providers [T1547.003]
12+
references:
13+
- https://stmxcsr.com/persistence/time-provider.html
14+
- https://learn.microsoft.com/en-us/windows/win32/sysinfo/time-provider?redirectedfrom=MSDN
15+
features:
16+
- and:
17+
- match: set registry value
18+
- string: /System\\(CurrentControlSet|ControlSet001)\\Services\\W32Time\\TimeProviders\\/i
19+
- string: /^DllName$/i

‎nursery/persist-via-ts-initialprogram-registry-key.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule:
2+
meta:
3+
name: persist via TS InitialProgram registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://persistence-info.github.io/Data/tsinitialprogram.html
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- string: /\\Policies\\Microsoft\\Windows NT\\Terminal Services/i
19+
- string: /System\\(CurrentControlSet|ControlSet001)\\Control\\Terminal Server\\WinStations\\RDP-Tcp/i
20+
- string: /^InitialProgram$/i

‎nursery/persist-via-userinitmprlogonscript-registry-value.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via UserInitMprLogonScript registry value
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Boot or Logon Initialization Scripts::Logon Script (Windows) [T1037.001]
12+
references:
13+
- https://attack.mitre.org/techniques/T1037/001/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Environment/i
18+
- string: /UserInitMprLogonScript/i

‎nursery/persist-via-windows-error-reporting-registry-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: persist via Windows Error Reporting registry key
4+
namespace: persistence/registry
5+
authors:
6+
- j.j.vannielen@utwente.nl
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Persistence::Event Triggered Execution [T1546]
12+
references:
13+
- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /Microsoft\\Windows\\Windows Error Reporting\\Hangs/i
18+
- string: /Debugger/i

‎persistence/scheduled-tasks/schedule-task-via-schtasks.yml

+18-7
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,29 @@ rule:
44
namespace: persistence/scheduled-tasks
55
authors:
66
- 0x534a@mailbox.org
7+
- j.j.vannielen@utwente.nl
78
scopes:
89
static: function
910
dynamic: call
1011
att&ck:
1112
- Persistence::Scheduled Task/Job::Scheduled Task [T1053.005]
13+
references:
14+
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
15+
- https://stmxcsr.com/persistence/scheduled-tasks.html
1216
examples:
1317
- 79cde1aa711e321b4939805d27e160be:0x401440
1418
features:
15-
- and:
16-
- match: host-interaction/process/create
17-
- or:
18-
- and:
19-
- string: /schtasks/i
20-
- string: /\/create /i
21-
- string: /Register-ScheduledTask /i
19+
- or:
20+
- and:
21+
- match: set registry value
22+
- string: /Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\/i
23+
- string: /^Actions$/i
24+
- and:
25+
- match: host-interaction/process/create
26+
- or:
27+
- and:
28+
- string: /schtasks/i
29+
- or:
30+
- string: /\/change/i
31+
- string: /\/create/i
32+
- string: /Register-ScheduledTask /i

0 commit comments

Comments
 (0)
Please sign in to comment.