Cloud Signature Update Agent — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cloud-signature-update-agent/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Startup or Run Key Registry Modificationhttps://feed.craftedsignal.io/briefs/2024-01-run-key-registry-modification/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-run-key-registry-modification/Attackers modify registry run keys or startup keys to achieve persistence by referencing a program that executes when a user logs in or the system boots.Attackers often modify registry run keys to achieve persistence on a system. By adding entries to these keys, they ensure that a malicious program executes automatically whenever a user logs in. This technique allows the attacker to maintain access to the compromised system even after reboots or other interruptions. The programs added to these run keys execute under the context of the user account, inheriting its permissions. This activity is often difficult to distinguish from legitimate software installations or updates, requiring careful analysis to identify malicious intent. Elastic has observed this activity and created a detection rule to identify this behavior.

Attack Chain

  1. The attacker gains initial access to the target system.
  2. The attacker identifies registry run key locations for persistence.
  3. The attacker modifies a registry run key (e.g., HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) using tools such as reg.exe.
  4. The attacker adds a malicious executable path to the registry key.
  5. The system is restarted, or a user logs in.
  6. The malicious executable is launched automatically as part of the logon process.
  7. The malicious executable establishes a connection to a command-and-control server.
  8. The attacker gains remote access to the compromised system.

Impact

Successful exploitation allows attackers to maintain persistent access to compromised systems, enabling them to perform unauthorized activities such as data theft, lateral movement, and deployment of ransomware. While each instance may not cause immediate critical damage, the cumulative effect of multiple persistent infections across an environment can lead to significant data breaches and operational disruption. The Elastic rule attempts to minimize false positives with built-in filters for common legitimate applications and processes like ctfmon.exe, but tuning is required.

Recommendation

  • Deploy the Sigma rule provided below to detect suspicious modifications to registry run keys and tune it to filter out legitimate application updates.
  • Enable registry event logging to capture modifications made to the registry, ensuring that the Sigma rule can function correctly.
  • Investigate any alerts generated by the Sigma rule, examining the parent process of the process modifying the registry for suspicious activity.
  • Block known malicious executables and domains identified during triage to prevent further infection.
  • Use endpoint detection and response (EDR) solutions like Elastic Defend to gain enhanced visibility into endpoint activity and detect malicious behavior associated with persistence mechanisms.
]]>lowadvisorypersistenceregistryrunkey