sigmahighHunting

Potential Persistence Via MyComputer Registry Keys

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Detection Query

selection:
  TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer
  TargetObject|endswith: (Default)
condition: selection

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2022-08-09

Data Sources

windowsRegistry Set Events

Platforms

windows

References

https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/

Tags

attack.persistence

Raw Content

title: Potential Persistence Via MyComputer Registry Keys
id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
status: test
description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
references:
    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-09
modified: 2024-01-11
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
        TargetObject|endswith: '(Default)'
    condition: selection
falsepositives:
    - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high