Elastic Defend high stable eql

Unusual Startup Shell Folder Modification

Identifies suspicious startup shell folder modifications. An adversary may attempt to change the default startup directory in order to bypass detections that monitor for suspicious file creation events in the default Windows Startup folder.

View Source

Detection Logic

registry where
  user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and
  registry.path : (
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
     ) and
  registry.data.strings != null and
   // Normal Startup Folder Paths
   not registry.data.strings :  (
           "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
           "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
           "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
           "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
           "\\\\*"
           ) and
   not process.executable :
             ("?:\\Windows\\explorer.exe",
              "?:\\Windows\\System32\\regsvr32.exe",
              "?:\\Windows\\System32\\runonce.exe",
              "?:\\Windows\\System32\\svchost.exe")

Field Validations

Loading…

Comments (0)

Loading comments...