Modification of CurrentControlSet Registry Autorun Extensibility Points

This brief addresses the monitoring of critical Windows Registry keys within 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control' that act as Autostart Extensibility Points (ASEPs). Threat actors frequently target these keys to achieve persistence or perform privilege escalation by ensuring malicious code executes during system startup or service initialization. Because these locations are rarely modified by standard user activity, changes to these keys by non-system processes or unexpected binaries often indicate malicious intent. Defenders should monitor these registry paths to identify unauthorized persistence mechanisms that survive reboots and bypass common user-land startup detection.

Attack Chain

1. Attacker gains administrative access to the target host.
2. Attacker identifies a registry-based persistence target, such as 'Lsa\Notification Packages' or 'Print\Monitors'.
3. Attacker develops or drops a malicious DLL or executable intended for persistence.
4. Attacker uses legitimate tools (e.g., reg.exe) or custom scripts to modify the targeted registry key.
5. The Windows system reads the registry configuration upon the next boot or service restart.
6. The system executes the path or loads the DLL specified in the modified registry key with system-level privileges.
7. The malicious code achieves execution in a privileged context, completing the persistence cycle.

Impact

Successful manipulation of these keys allows attackers to maintain long-term, stealthy access to a compromised system with high-level privileges. Because these points execute early in the OS lifecycle, they can be used to inject code into critical system processes, potentially leading to full system compromise, data exfiltration, or further lateral movement within the network.

Recommendation

1. Deploy the provided Sigma rule to monitor for 'registry_set' activity targeting the 'CurrentControlSet\Control' hive.
2. Baseline your environment by identifying legitimate installers or administrative tools that modify these keys to reduce noise.
3. Investigate any process other than trusted system installers (e.g., spoolsv.exe with legitimate drivers) that performs write operations to these specific registry paths.