Skip to content
Threat Feed
Subscribe
medium advisory

Potential Persistence via AppCompat RegisterAppRestart Layer

Attackers may abuse the REGISTERAPPRESTART compatibility shim to achieve persistence by forcing malicious applications to restart automatically upon system login.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 10, 03:09 UTC
Detection
1 rule
Source quality
A2Roughly even chance

The Windows Application Compatibility (AppCompat) framework allows the application of specific shims or compatibility layers to executables to resolve legacy compatibility issues. Research indicates that the 'REGISTERAPPRESTART' layer can be abused as a persistence mechanism. By modifying registry keys within 'AppCompatFlags\Layers', an attacker can force an arbitrary executable to register for restart via the 'RegisterApplicationRestart' API. This causes the target application to launch automatically when the system restarts or the user logs in.

Impact

Successful abuse of this technique results in persistent, automatic execution of a chosen binary with the privileges of the user account associated with the registry modification.

Recommendation

  • Deploy the provided Sigma rule to monitor modifications to 'AppCompatFlags\Layers'.
  • Baseline existing entries in 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers' to identify authorized compatibility settings.
  • Investigate registry modifications targeting non-standard or user-writable paths for unexpected application shims.

Immediate actions

Deploy Sigma rule to identify registry modifications targeting AppCompat layers.

Detection Engineering 48h

Mitigations

Baseline legitimate applications using AppCompat layers and restrict write access to registry hives managing these keys.

medium_term IT Operations

T1546.011

Detection coverage 1

Detect Potential Persistence via AppCompat RegisterAppRestart Layer

medium

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application, which can be abused for persistence.

sigma tactics: persistence, privilege-escalation techniques: T1546.011 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →