Run key value pointing at a script host or user-writable path

1title: Run key value pointing at a script host or user-writable path2id: c6a24e62-304f-4035-bc66-261578f63f633status: experimental4description: |5  Matches a Sysmon EventID 13 registry write whose target is one of the6  autostart Run keys and whose written data names a scripting host, a LOLBin or7  a path a normal user can write to. Two gates are needed because the key on its8  own is not an indicator: on `registry_set` the value name is appended to9  `TargetObject` and the data lands in `Details`, so the key gate is a contains10  on `\CurrentVersion\Run\` and its RunOnce/RunOnceEx/RunServices siblings —11  which also picks up the `Wow6432Node` copies — while the payload gate reads12  `Details`. The payload gate carries each user-writable location twice, as a13  literal path and as the environment variable that expands to it, because a Run14  value is very often written as `REG_EXPAND_SZ` and Sysmon reports `Details`15  exactly as stored: `%AppData%\svc.exe` never contains the string16  `\AppData\Roaming\`, so a literal-path-only gate misses the most common shape17  of this technique. Only the Registry half of T1547.001 is covered; a payload18  dropped into the Startup folder is a file write, and AN1032 offers no19  file-event log source to carry it. No hive prefix is anchored, because Sysmon writes HKCU as `HKU`20  followed by the account SID, so a `HKEY_CURRENT_USER` prefix would never21  match. MITRE names the `RegistryKeyPath` and `ImagePath` knobs; the marker22  list in `selection_payload` is authored here, not taken from MITRE. Two23  things AN1032 asks for are outside what this can do: the correlation of the24  registry write with an execution 5-10 minutes later needs a timeframe, which25  this corpus does not model, and a Run value that points at a signed26  executable under `Program Files` is caught by neither gate — persistence27  established by hijacking an already-registered entry is invisible here.28  The analytic's third log source, Sysmon EventID 14 (`registry_rename`), is29  not used: a rename carries no value data, so the payload gate has nothing to30  read. Sysmon registry events must actually be collected for this subtree —31  most shipped Sysmon configurations filter EventID 13 down to an allowlist of32  keys, and a filtered key produces silence that reads like a clean result.33  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0365, not hand-written and not tested by its author. Any lab result is on this rule's own page.34references:35  - https://attack.mitre.org/techniques/T1547/00136  - https://attack.mitre.org/detectionstrategies/DET036537author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)38date: 2026-08-1639tags:40  - attack.persistence41  - attack.privilege-escalation42  - attack.t1547.00143logsource:44  category: registry_set45  product: windows46detection:47  selection_runkey:48    TargetObject|contains:49      - '\CurrentVersion\Run\'50      - '\CurrentVersion\RunOnce\'51      - '\CurrentVersion\RunOnceEx\'52      - '\CurrentVersion\RunServices\'53      - '\CurrentVersion\RunServicesOnce\'54  selection_payload:55    Details|contains:56      - '\AppData\Local\'57      - '\AppData\Roaming\'58      - '\Users\Public\'59      - '\ProgramData\'60      - '\Windows\Temp\'61      - '%AppData%'62      - '%LocalAppData%'63      - '%UserProfile%'64      - '%Temp%'65      - '%Public%'66      - '%ProgramData%'67      - 'powershell'68      - 'pwsh'69      - 'cmd.exe'70      - 'mshta'71      - 'rundll32'72      - 'regsvr32'73      - 'wscript'74      - 'cscript'75      - 'certutil'76      - '.hta'77      - '.vbs'78      - '.ps1'79      - '.bat'80      - '.cmd'81      - '.scr'82  condition: selection_runkey and selection_payload83falsepositives:84  - "Per-user application installers and updaters registering their own auto-start entry from under \\AppData\\Local or \\AppData\\Roaming, or the %AppData% and %LocalAppData% forms of the same paths — chat clients, cloud-storage sync agents, browser update helpers and game launchers all install per-user by default and write exactly this shape. On a managed fleet these two path markers are the highest-volume match by a wide margin, which is what holds the level at low; a site that baselines them out can raise it for the remaining LOLBin and script-extension markers."85  - "Vendor uninstall, repair and patch stubs registering a RunOnce value that calls rundll32.exe or a .bat/.cmd cleanup script to finish file replacement after the next reboot — this is the documented Windows mechanism for deferred work, so it fires on ordinary software maintenance."86  - "Group Policy Preferences registry items and logon scripts that set a Run value calling powershell.exe or wscript.exe against a corporate script share; the value is rewritten on every policy refresh whether or not the data changed, so one configured host produces a steady repeating event."87  - "OEM factory images and endpoint-management agents that stage helper executables under \\ProgramData or \\Users\\Public and start them from the machine-wide Run key, which fires once on every freshly imaged or re-enrolled host."88level: low