HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\WindowsĪutocheck launch – within BootExecute value.User Logon Program Launch – within “load” value: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.Credit goes to Mitre ATT&CK for these, I’ve pulled out the paths below – Rather than log all registry changes, instead focus on these locations to best detect suspicious registry behavior. The service type field should be monitored to determine the access level of this new service, while the service start type field should be monitored for how the service is set to run.īelow are some very solid registry keys to monitor, all of which cover the persistence methods discussed above. Service installations should be planned and there are services that attackers would want to install on a high value system. This event code would be very loud to monitor across all areas, so we want to ensure it’s monitored on critical or otherwise sensitive systems. Rationalize Your Cybersecurity Spending.Protection Against User Account Attacks.Achieve Full Microsoft Sentinel Operating Potential.Evidence Seizure, Chain-of-Custody & Secure Storage.Palo Alto Networks Cortex XSIAM for Endpoint.
0 kommentar(er)
