MITRE CAR unknown stable spl

Modification of Default Startup Folder in the Registry Key 'Common Startup'

Detection of the modification of the registry key `Common Startup` located in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\`. When a user logs on, any files located in the Startup Folder are launched. Attackers may modify these folders with other files in order to evade detection set on these default folders. This detection focuses on EventIDs 4688 and 1 for process creation and EventID 4657 for the modification of the Registry Keys.

View Source

Detection Logic

(((EventCode="4688" 
OR EventCode="1") (CommandLine="*reg*" 
AND CommandLine="*add*" 
AND CommandLine="*/d*") 
OR (CommandLine="*Set-ItemProperty*" 
AND CommandLine="*-value*") CommandLine="*Common Startup*") 
OR ((EventCode="4657" ObjectValueName="Common Startup") 
OR (EventCode="13" TargetObject="*Common Startup")))

Field Validations

Loading…

Comments (0)

Loading comments...