Registry Persistence via Service in Safe Mode

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Sigma rule (View on GitHub)

 1title: Registry Persistence via Service in Safe Mode
 2id: 1547e27c-3974-43e2-a7d7-7f484fb928ec
 3status: experimental
 4description: Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network
 7    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
 8author: frack113
 9date: 2022/04/04
10modified: 2024/03/25
11tags:
12    - attack.defense_evasion
13    - attack.t1564.001
14logsource:
15    category: registry_set
16    product: windows
17detection:
18    selection:
19        TargetObject|contains:
20            - '\Control\SafeBoot\Minimal\'
21            - '\Control\SafeBoot\Network\'
22        TargetObject|endswith: '\(Default)'
23        Details: 'Service'
24    filter_optional_sophos:
25        Image: 'C:\WINDOWS\system32\msiexec.exe'
26        TargetObject|endswith:
27            - '\Control\SafeBoot\Minimal\SAVService\(Default)'
28            - '\Control\SafeBoot\Network\SAVService\(Default)'
29    condition: selection and not 1 of filter_optional_*
30falsepositives:
31    - Unknown
32level: high

References

Related rules

to-top