Registry Run Key Persistence via reg.exe

Autorun persistence written to a Run key with reg.exe

• T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder· Persistence

Converted from Sigma; review before enabling.

Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/sigma/sigma.reg_add_run_key.yaml, licensed under the Detection Rule License 1.1.

id: sigma.reg_add_run_key
version: 1.0.0
status: experimental
severity: medium
confidence: 0.6
platforms:
- windows
mitre_techniques:
- T1547.001
description: Autorun persistence written to a Run key with reg.exe — Sigma sample
match:
  event_category: process
  process_path_contains_any:
  - \reg.exe
  command_line_contains_any:
  - \CurrentVersion\Run
  - \CurrentVersion\RunOnce
false_positive_guidance: Converted from Sigma; review before enabling.

Adapted from the SigmaHQ rule “Registry Run Key Persistence via reg.exe”, distributed under the Detection Rule License 1.1. SigmaHQ.

• Autostart registry hijackSeverity high
• Run key modifiedSeverity high
• Startup folder executable writeSeverity high
• Kernel module loadedSeverity high