t1547 | LoFP

t1547

Title	Tags
active setup installer may add or modify this registry.	t1547 t1547.014 endpoint splunk
administrator or network operator can create file in this folders for automation purposes. please update the filter macros to remove false positives.	t1037 T1037.004 t1547 t1547.006 endpoint splunk
administrator or network operator can execute this command. please update the filter macros to remove false positives.	t1003 T1003.008 t1016 t1070 t1070.004 t1136 t1136.001 t1222 t1222.002 t1485 t1547 t1547.006 t1548 t1548.001 t1548.003 t1574 t1574.006 endpoint splunk
administrators may allow creation of script or exe in this path.	t1204 t1204.002 t1547 t1547.001 endpoint splunk
creation of non-default, legitimate at usage	t1218 t1547 windows sigma
depending on your environment accepted applications may leverage this at times. it is recommended to search for anomalies inidicative of malware.	t1547 t1547.001 windows sigma
discord	t1007 t1012 t1547 t1547.001 windows sigma
false positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. it is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. modify the search to include additional known good paths for vcruntime140.dll to reduce false positives.	t1547 t1574.002 endpoint splunk
false positives are unknown and filtering may be required.	t1547 T1547.012 endpoint splunk
fp could be caused by legitimate application writing shortcuts for example. this folder should always be inspected to make sure that all the files in there are legitimate	t1547 t1547.001 windows sigma
legitimate admin or third party scripts. baseline according to your environment	t1547 t1547.001 windows sigma
legitimate administrative activity	t1484 t1547 windows elastic
legitimate administrative use	t1046 t1082 t1135 t1505 t1505.005 t1546 t1546.007 t1546.008 t1547 t1547.001 t1547.002 t1547.010 t1547.014 t1556 t1556.002 t1557 t1562 t1562.002 t1564 t1564.002 t1574 t1574.007 windows sigma
legitimate administrator sets up autorun keys for legitimate reason	t1546 t1546.009 t1547 t1547.001 windows sigma
legitimate administrator sets up autorun keys for legitimate reasons.	t1547 t1547.001 windows sigma
legitimate custom shim installations will also trigger this rule	t1546 t1546.011 t1547 t1547.009 windows sigma
legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons.	t1547 t1547.001 windows sigma
limited false positives have been identified. there are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.	t1547 T1547.012 endpoint splunk
limited false positives. filter as needed.	t1055 t1059 t1059.001 t1547 T1547.012 endpoint splunk
operations performed through windows sccm or equivalent	t1547 t1547.009 windows sigma
pnputil.exe being executed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1547 windows sigma
pnputil.exe being used may be performed by a system administrator.	t1547 windows sigma
possible new printer installation may add driver component on this registry.	t1547 T1547.012 endpoint splunk
rare legitimate usage of some of the extensions mentioned in the rule	t1547 t1547.001 windows sigma
read only access list authority	t1547 t1547.009 windows sigma
security tools and device drivers may run these programs in order to load legitimate kernel modules. use of these programs by ordinary users is uncommon.	t1547 _deprecated elastic
software installers downloaded and used by users	t1547 t1547.001 windows sigma
software using weird folders for updates	t1547 t1547.001 windows sigma
some false positives may occur with admin scripts that set wt settings.	t1547 t1547.015 windows sigma
there are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.	t1547 t1547.001 endpoint splunk
there is usually no reason to remove modules, but some buggy modules require it. these can be exempted by username. note that some linux distributions are not built to support the removal of modules at all.	t1547 t1562 linux elastic
updated windows application needed in safe boot may used this registry	t1547 t1547.001 endpoint splunk
windows administrator tasks or troubleshooting	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma
windows management scripts or software	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma
you will encounter noise from legitimate print-monitor registry entries.	t1547 t1547.010 endpoint splunk