Submission Date: 2013/01/25

Update Date:

Information Domain: Analytic, Host

Data Subtypes: Registry

Analytic Type: Situational Awareness, TTP

Applicable Platforms: Windows

Contributors: MITRE



The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

Utilizes the Sysinternals autoruns tool (ignoring validated Microsoft entries). Primarily not a detection analytic by itself but through analysis of results by an analyst can be used for such. Building another analytic on top of this one identifying unusual entries would likely be a beneficial alternative.

ATT&CK Detections

Technique Subtechnique(s) Tactic(s) Level of Coverage
Create or Modify System Process Windows Service Persistence Moderate
Scheduled Task/Job Scheduled Task Persistence Moderate
Boot or Logon Autostart Execution Registry Run Keys / Startup Folder, Port Monitors, Winlogon Helper DLL Persistence Moderate
Hijack Execution Flow Path Interception by PATH Environment Variable, Path Interception by Search Order Hijacking, Path Interception by Unquoted Path, Services File Permissions Weakness, Services Registry Permissions Weakness Persistence, Privilege Escalation Moderate
Event Triggered Execution Change Default File Association, Windows Management Instrumentation Event Subscription, Accessibility Features, AppInit DLLs Privilege Escalation, Persistence Moderate
Modify Registry N/A Persistence, Execution Moderate
Boot or Logon Initialization Scripts Logon Script (Windows) Persistence Moderate

D3FEND Techniques

ID Name
D3-SICA System Init Config Analysis