Registry Persistence via Service in Safe Mode
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Sigma rule (View on GitHub)
1title: Registry Persistence via Service in Safe Mode
2id: 1547e27c-3974-43e2-a7d7-7f484fb928ec
3status: experimental
4description: Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network
7 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
8author: frack113
9date: 2022-04-04
10modified: 2024-03-25
11tags:
12 - attack.defense-evasion
13 - attack.t1564.001
14logsource:
15 category: registry_set
16 product: windows
17detection:
18 selection:
19 TargetObject|contains:
20 - '\Control\SafeBoot\Minimal\'
21 - '\Control\SafeBoot\Network\'
22 TargetObject|endswith: '\(Default)'
23 Details: 'Service'
24 filter_optional_sophos:
25 Image: 'C:\WINDOWS\system32\msiexec.exe'
26 TargetObject|endswith:
27 - '\Control\SafeBoot\Minimal\SAVService\(Default)'
28 - '\Control\SafeBoot\Network\SAVService\(Default)'
29 condition: selection and not 1 of filter_optional_*
30falsepositives:
31 - Unknown
32level: high
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Displaying Hidden Files Feature Disabled
- Hidden Files and Directories
- Hiding Files with Attrib.exe
- PowerShell Logging Disabled Via Registry Key Tampering
- Set Suspicious Files as System Files Using Attrib.EXE