Detectionmediumtest
Potential Persistence Via AppCompat RegisterAppRestart Layer
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Mon Jan 01b86852fb-4c77-48f9-8519-eb1b2c308b59windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\'
Details|contains: 'REGISTERAPPRESTART'
condition: selectionFalse Positives
Legitimate applications making use of this feature for compatibility reasons
References
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
b86852fb-4c77-48f9-8519-eb1b2c308b59
Status
test
Level
medium
Type
Detection
Created
Mon Jan 01
Path
rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.t1546.011