back

Find sigma rule :heavy_check_mark:

Attack: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account’s associated permissions level.

Adversaries may abuse Active Setup by creating a key under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

MITRE

Tactic

technique

Test : HKLM - Add atomic_test key to launch executable as part of user setup

OS

Description:

This test will create an “atomic_test” key under ‘HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components’ to launch calc by configuring an active setup executable and forcing to run active setup using the “runonce.exe /AlternateShellStartup” command. Without the “runonce.exe /AlternateShellStartup” command it would run during the next logon for each user.

Note: If you logout before running the cleanup command, you will be required to go through the OOBE (out-of-box experience) setup sequence to log back in. The payload will only run once unless the cleanup command is run in between tests.

Active Setup Explained

Executor

powershell

Sigma Rule

back