Potential Persistence Via App Paths Default Property
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to the "Default" property for keys located in the \\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME contains "\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" OR (OBJECTNAME endswith "\SOFTWARE\Microsoft\Windows\CurrentVersion" AND OBJECTVALUENAME startswith "App Paths")) AND (OBJECTNAME endswith "(Default),Path" OR OBJECTVALUENAME endswith "(Default)") AND INFORMATION contains "\Users\Public,\AppData\Local\Temp\,\Windows\Temp\,\Desktop\,\Downloads\,%temp%,%tmp%,iex,Invoke-,rundll32,regsvr32,mshta,cscript,wscript,.bat,.hta,.dll,.ps1" select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
