- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.
cybersecurity
threat-hunting
persistence
registry-run-keys
t1547-001
sysmon
threat-hunting
windows-forensics
mitre-attack
1.0
mahipal
Apache-2.0
Executable Denylisting
Execution Isolation
File Metadata Consistency Validation
Content Format Conversion
File Content Analysis
DE.CM-01
DE.AE-02
DE.AE-07
ID.RA-05
T1046
T1057
T1082
T1083
T1547
Hunting for Registry Run Key Persistence
Overview
Registry Run keys (T1547.001) are one of the most commonly used persistence mechanisms by adversaries. When a program is added to a Run key in the Windows registry, it executes automatically when a user logs in. Attackers abuse keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and their RunOnce counterparts to maintain persistence. Sysmon Event ID 13 (RegistryEvent - Value Set) captures registry value modifications including the target object path, the process that made the change, and the new value. Detection involves monitoring these events for suspicious executables in temp directories, encoded PowerShell commands, LOLBin paths, and processes that do not normally create Run key entries. Chaining Event 13 with Event 1 (Process Creation) and Event 11 (FileCreate) strengthens detection by confirming payload creation and execution.
When to Use
When investigating security incidents that require hunting for registry run key persistence
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Windows systems with Sysmon installed and configured to log Event ID 13
Sysmon config with RegistryEvent rules for Run/RunOnce keys
Python 3.9+ with json, xml.etree.ElementTree, re modules
SIEM or log aggregator collecting Sysmon logs (Splunk, Elastic, Sentinel)
Knowledge of legitimate auto-start programs for baseline comparison
Steps
Collect Sysmon Event ID 13 logs filtered for Run/RunOnce key paths
Compare against known-good baseline of legitimate auto-start entries
Check if the modifying process (Image) is unusual (cmd.exe, powershell.exe, python.exe)
Chain with Event ID 1 to verify if the registered binary was recently created
Generate detection report with MITRE ATT&CK mapping and severity scores
Produce Sigma/Splunk detection rules from findings
Expected Output
A JSON report listing suspicious Run key entries with the registry path, value written, modifying process, timestamp, MITRE technique mapping, severity rating, and recommended Sigma detection rules.
mukul975
cb8d79e068