Techniques
Sample rules
Potential Persistence Via App Paths Default Property
- source: sigma
- technicques:
- t1546
- t1546.012
Description
Detects changes to the “Default” property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application’s executable file name to that file’s fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.
Detection logic
condition: selection
selection:
Details|contains:
- \Users\Public
- \AppData\Local\Temp\
- \Windows\Temp\
- \Desktop\
- \Downloads\
- '%temp%'
- '%tmp%'
- iex
- Invoke-
- rundll32
- regsvr32
- mshta
- cscript
- wscript
- .bat
- .hta
- .dll
- .ps1
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
TargetObject|endswith:
- (Default)
- Path