Detect Active Setup in Microsoft Sentinel
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer. These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. This value will serve as the program that will be executed when a user logs into the computer. Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1547 Boot or Logon Autostart Execution
- Sub-technique
- T1547.014 Active Setup
- Canonical reference
- https://attack.mitre.org/techniques/T1547/014/
KQL Detection Query
let ActiveSetupPath = @"SOFTWARE\Microsoft\Active Setup\Installed Components";
let KnownGUIDs = dynamic([
"{89820200-ECBD-11cf-8B85-00AA005B4383}",
"{22d6f312-b0f6-11d0-94ab-0080c74c7e95}",
"{2C7339CF-2B09-4501-B3F3-F3508C9228ED}",
"{44BBA840-CC51-11CF-AAFA-00AA00B6015C}",
"{6BF52A52-394A-11d3-B153-00C04F79FAA6}",
"{89B4C1CD-B018-4511-B0A1-5476DBF70820}"
]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has ActiveSetupPath
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| extend GUID = extract(@"Installed Components\\({[^}]+})", 1, RegistryKey)
| extend IsKnownGUID = GUID in (KnownGUIDs)
| extend IsStubPath = RegistryKey endswith "StubPath" or RegistryValueName =~ "StubPath"
| extend StubPathValue = iff(IsStubPath, tostring(RegistryValueData), "")
| extend SuspiciousStubPath = StubPathValue has_any ("cmd.exe", "powershell", "mshta.exe", "rundll32", "regsvr32", "wscript", "cscript", "certutil", ".bat", ".vbs", ".js", ".hta", "http://", "https://")
| where not(IsKnownGUID) or IsStubPath
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, GUID, IsKnownGUID, IsStubPath, SuspiciousStubPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descDetects Active Setup persistence by monitoring registry modifications to HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components. Extracts the GUID from the registry path and compares against known legitimate GUIDs (Internet Explorer, Windows Media Player, .NET Framework, etc.). Flags entries where StubPath contains suspicious executables (cmd.exe, powershell, mshta, rundll32, scripting engines) or points to URLs, batch files, or script files. Unknown GUIDs with any StubPath modification are flagged for review.
Data Sources
Required Tables
False Positives & Tuning
- Software installations that use Active Setup to run first-use configuration commands (e.g., Microsoft Office, Visual Studio, .NET Framework adding per-user registry settings)
- Windows component updates that modify existing Active Setup entries to update version numbers, triggering re-execution of StubPath commands
- Group Policy deployed applications that use Active Setup to ensure per-user installation on first logon to shared workstations/terminal servers
- Antivirus or endpoint security products that register Active Setup entries for per-user agent configuration
Other platforms for T1547.014
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Active Setup StubPath Persistence with Custom GUID
Expected signal: Sysmon Event ID 12: Registry Key Created for the GUID subkey. Sysmon Event ID 13: Registry Value Set for StubPath, ComponentID, and Version values. Security Event ID 4688: Process creation for reg.exe with the full command line.
- Test 2Active Setup with Suspicious LOLBin StubPath
Expected signal: Sysmon Event ID 13: Registry Value Set with Details containing 'cmd.exe /c'. On next user logon: Sysmon Event ID 1 for cmd.exe spawned by userinit.exe/explorer.exe. Sysmon Event ID 11 for file creation in %TEMP%.
- Test 3Active Setup via PowerShell Registry Manipulation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the registry manipulation command. Sysmon Event ID 12: Registry Key Created. Sysmon Event ID 13: Registry Value Set for StubPath and Version. PowerShell ScriptBlock Log Event ID 4104 with the full script.
References (8)
- https://attack.mitre.org/techniques/T1547/014/
- https://helgeklein.com/blog/2010/04/active-setup-explained/
- https://digital-forensics.sans.org/summit-archives/2010/35-glyer-apt-persistence-mechanisms.pdf
- https://citizenlab.ca/2015/12/packrat-report/
- https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/
- https://technet.microsoft.com/en-us/sysinternals/bb963902
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.014/T1547.014.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1547.014 including response playbook, investigation guide, and atomic red team tests.