Persistence via the Windows Registry

Description

The Windows Registry offers extensive automation and configuration capabilities for both the operating system and applications.

Attackers often exploit this by injecting malicious configurations into critical registry paths, enabling automatic loading of malware or execution during specific events. These persistence techniques allow malicious code to activate during system startup or user logon, and may also maintain access by modifying other registry entries—such as those related to context menus, services, or executable file associations—making the attack chain more covert and resilient.

Registry-based persistence is now a critical component of real-world attack chains. Timely detection of related behavior is essential to prevent backdoor installation and to disrupt lateral movement.

Challenge Objective

Develop detection rules to identify all persistence actions achieved via the registry. This includes any behavior involving the creation or modification of critical registry keys for persistence.

When writing detection queries, ensure the Computer field is included in the output for further validation.

Data Sample

Data source: Sysmon; sample data:

{  "Channel": "Microsoft-Windows-Sysmon/Operational",  "CommandLine": "",  "Company": "",  "Computer": "DESKTOP-XXXXX",  "CurrentDirectory": "",  "Description": "",  "Details": "calc.exe",  "EventId": "13",  "EventType": "SetValue",  "FileVersion": "",  "Hashes": "",  "Image": "C:\\WINDOWS\\system32\\services.exe",  "IntegrityLevel": "",  "LogonGuid": "",  "LogonId": "",  "OriginalFileName": "",  "ParentCommandLine": "",  "ParentImage": "",  "ParentProcessGuid": "",  "ParentProcessId": "",  "ParentUser": "",  "ProcessGuid": "{769c9af7-3ab8-686e-0b00-000000000a00}",  "ProcessId": "648",  "Product": "",  "RuleName": "-",  "SystemTime": "2025-07-25T09:02:48.7239866Z",  "TargetObject": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\calc",  "TerminalSessionId": "",  "User": "NT AUTHORITY\\SYSTEM",  "UtcTime": "2025-07-25 09:02:48.716",}

References

• T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder