Detect Boot or Logon Autostart Execution in CrowdStrike LogScale
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon, including automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1547 Boot or Logon Autostart Execution
- Canonical reference
- https://attack.mitre.org/techniques/T1547/
LogScale Detection Query
#event_simpleName = "AsepValueUpdate" OR #event_simpleName = "AsepValueDelete"
| regex(field=RegistryPath, regex="(?i)(CurrentVersion\\\\Run(Once(Ex)?|Services(Once)?)?|CurrentVersion\\\\Policies\\\\Explorer\\\\Run|CurrentVersion\\\\Winlogon|Active Setup\\\\Installed Components|Control\\\\Lsa\\\\(Authentication|Security) Packages|Control\\\\Print\\\\(Monitors|Environments)|Services\\\\W32Time\\\\TimeProviders|Explorer\\\\(User )?Shell Folders)")
| table([@timestamp, ComputerName, event_simpleName, RegistryPath, RegistryValueName, RegistryValueData, ImageFileName, CommandLine, UserName])
| sort(field=@timestamp, order=desc)Detects CrowdStrike Falcon AsepValueUpdate and AsepValueDelete events on Windows autostart execution registry paths (T1547). The AsepValueUpdate event fires when Auto Start Execution Point (ASEP) registry values are created or modified, providing high-fidelity coverage of Run keys, Winlogon, LSA packages, Print Monitors, and Shell Folder paths.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon itself and other EDR/AV products register entries in Run keys or Active Setup during sensor updates and initial deployment, generating benign ASEP events
- Legitimate application updates (browsers, productivity suites) modify their own Run key entries to update executable paths after version upgrades, typically from signed updater processes
- Microsoft Office Click-to-Run and similar subscription software deployment mechanisms write to Active Setup and RunOnce keys during installation and upgrade sequences
Other platforms for T1547
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Registry Run Key for Persistence
Expected signal: Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.
- Test 2Drop File in Startup Folder
Expected signal: Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.
- Test 3Modify Winlogon Shell Value
Expected signal: Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.
References (6)
- https://attack.mitre.org/techniques/T1547/
- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
- https://technet.microsoft.com/en-us/sysinternals/bb963902
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547/T1547.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry_set
- https://web.archive.org/web/20160214140250/http://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
Unlock Pro Content
Get the full detection package for T1547 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (14)
- T1547.001Registry Run Keys / Startup Folder
- T1547.002Authentication Package
- T1547.003Time Providers
- T1547.004Winlogon Helper DLL
- T1547.005Security Support Provider
- T1547.006Kernel Modules and Extensions
- T1547.007Re-opened Applications
- T1547.008LSASS Driver
- T1547.009Shortcut Modification
- T1547.010Port Monitors
- T1547.012Print Processors
- T1547.013XDG Autostart Entries
- T1547.014Active Setup
- T1547.015Login Items