name: Registry Keys Used For Persistence
id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
version: 5
date: '2020-11-27'
author: David Dorsey, Splunk
type: batch
datamodel: []
description: The search looks for modifications to registry keys that can be used
  to launch an application or service at system startup.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run*
  OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell*
  OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet*
  OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices*
  OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows
  NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*)
  by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
  that records registry activity from your hosts to populate the endpoint data model
  in the registry node. This is typically populated via endpoint detection-and-response
  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
  used for this search is typically generated via logs that report reads and writes
  to the registry.
known_false_positives: There are many legitimate applications that must execute on
  system startup and will use these registry keys to accomplish that task.
references: []
tags:
  analytic_story:
  - Suspicious Windows Registry Activities
  - Suspicious MSHTA Activity
  - DHS Report TA18-074A
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Ransomware
  - Windows Persistence Techniques
  - 'Emotet Malware  DHS Report TA18-201A '
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1547.001
  nist:
  - PR.PT
  - DE.CM
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Registry.registry_key_name
  - Registry.registry_path
  - Registry.dest
  - Registry.user
  security_domain: endpoint
