Run key modified
highWindowsSingle eventstablewindows.persistence.run_key_modified · v1.0.0
What it detects
Detects a value being written under a CurrentVersion\Run / RunOnce registry key (Sysmon 13) — autostart persistence that survives reboots.
MITRE ATT&CK mapping
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder· Persistence
False positives and triage
Installers add Run entries for updaters and tray apps. Judge by the target binary path (user-writable locations are suspicious) and the writing process.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/run_key_persistence.yaml, licensed under the Apache License 2.0.
id: windows.persistence.run_key_modified
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1547.001]
description: |
Detects a value being written under a CurrentVersion\Run / RunOnce registry key
(Sysmon 13) — autostart persistence that survives reboots.
match:
event_category: registry
event_action: registry_value_set
registry_path_contains_any:
- "\\CurrentVersion\\Run"
- "\\CurrentVersion\\RunOnce"
false_positive_guidance: |
Installers add Run entries for updaters and tray apps. Judge by the target binary path
(user-writable locations are suspicious) and the writing process.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.