Elastic Defend high stable eql

Registry Run Key Prefixed with Asterisk

Run and RunOnce registry keys cause programs to run each time that a user logs on. By default, these keys are ignored when the computer is started in Safe Mode. The value name of RunOnce keys can be prefixed with an asterisk (*) to force the program to run even in Safe Mode. Attackers have been observed in the wild using this technique to execute ransomware in Safe Mode.

View Source

Detection Logic

registry where registry.data.strings != null and
    user.id : ("S-1-5-21*", "S-1-12-*") and
    registry.path : (
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"
    ) and
  startswith(registry.value, "*") and
  /* Issue #318 */
  not (process.name : "Lmi_*.exe" and registry.value : "*LogMeInRescue*") and
  not (process.name : "G2AC_LauncherCustomer.exe" and registry.value : "*GoToAssist*") and
  not (process.name : "G2AC_SessionControl.exe" and registry.value : "*GoToAssist") and
  not (process.code_signature.subject_name == "GoTo Technologies USA, LLC" and process.code_signature.trusted == true) and
  not process.executable :
           ("?:\\Windows\\System32\\mmc.exe",
            "?:\\WINDOWS\\system32\\rstrui.exe",
            "?:\\Program Files (x86)\\*.exe",
            "?:\\WINDOWS\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\msiexec.exe",
            "?:\\Program Files\\*.exe")

Field Validations

Loading…

Comments (0)

Loading comments...