Detectionhightest

Potential Persistence Via AutodialDLL

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 10Updated Thu Aug 17e6fe26ee-d063-4f5b-b007-39e90aaf50e3windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\Services\WinSock2\Parameters\AutodialDLL'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

e6fe26ee-d063-4f5b-b007-39e90aaf50e3

Status

test

Level

high

Type

Detection

Created

Wed Aug 10

Modified

Thu Aug 17

Author

Path

rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml

Raw Tags

attack.persistence