Potential Persistence Via GlobalFlags
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "\Microsoft\Windows NT\CurrentVersion" AND OBJECTNAME contains "\Image File Execution Options" AND OBJECTNAME contains "\GlobalFlag") OR ((OBJECTNAME contains "\GlobalFlag" OR OBJECTVALUENAME contains "\GlobalFlag") OR (OBJECTNAME endswith "\Microsoft\Windows NT\CurrentVersion" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\Image File Execution Options" AND isExist(OBJECTVALUENAME)))) OR (((OBJECTNAME contains "\Microsoft\Windows NT\CurrentVersion" AND OBJECTNAME contains "\SilentProcessExit") OR ((OBJECTNAME endswith "\Microsoft\Windows NT\CurrentVersion" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\SilentProcessExit" AND isExist(OBJECTVALUENAME)))) AND (OBJECTNAME contains "\ReportingMode,\MonitorProcess" OR (OBJECTNAME contains "\ReportingMode,\MonitorProcess" OR OBJECTVALUENAME contains "\ReportingMode,\MonitorProcess"))) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Karneades, Jonhnathan Ribeiro, Florian Roth
