Modification of Windows NT CurrentVersion Autorun Registry Keys

This detection brief addresses the monitoring of registry modifications targeting Autostart Extensibility Points (ASEPs) located under the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' registry hive. Attackers frequently modify these keys to achieve persistence, as they control system processes, login shells, and initialization routines executed by the Windows operating system upon startup or user logon. Unauthorized changes to keys such as 'Winlogon', 'Appinit_Dlls', or 'Run' allow for the execution of arbitrary code with elevated privileges. Monitoring these paths is essential for detecting the initial stage of post-compromise persistence. This activity is a well-documented technique for maintaining long-term access in a compromised Windows environment and is frequently targeted by various threat actors.

Impact

Successful modification of these registry keys enables attackers to maintain persistence, execute malicious payloads automatically upon system reboot or user login, and potentially gain elevated system privileges if the modified key interacts with high-integrity processes like 'Winlogon' or 'Userinit'. This can lead to total system compromise, exfiltration of sensitive data, and long-term undetected access to the internal network.

Recommendation

Deploy the provided Sigma rule to monitor registry modification events ('registry_set') on Windows endpoints. Focus on filtering known-good administrative and installation activity to reduce noise, as installers often write to these keys during software deployment. Prioritize investigations of modifications by processes other than standard system installers or verified enterprise management software.