mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-07 03:00:19 +03:00
101 lines
4.3 KiB
Markdown
101 lines
4.3 KiB
Markdown
# Standards and References - Windows Persistence Hunting
|
|
|
|
## MITRE ATT&CK Persistence Techniques (TA0003)
|
|
|
|
### Boot or Logon Autostart Execution (T1547)
|
|
| Sub-Technique | Name | Registry/Location |
|
|
|---------------|------|-------------------|
|
|
| T1547.001 | Registry Run Keys / Startup Folder | HKLM/HKCU Run, RunOnce, Startup |
|
|
| T1547.002 | Authentication Package | HKLM\SYSTEM\CurrentControlSet\Control\Lsa |
|
|
| T1547.003 | Time Providers | HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders |
|
|
| T1547.004 | Winlogon Helper DLL | HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
|
|
| T1547.005 | Security Support Provider | HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages |
|
|
| T1547.006 | Kernel Modules and Extensions | Driver loading |
|
|
| T1547.009 | Shortcut Modification | .lnk files in Startup |
|
|
| T1547.010 | Port Monitors | HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors |
|
|
| T1547.012 | Print Processors | HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments |
|
|
| T1547.014 | Active Setup | HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components |
|
|
| T1547.015 | Login Items | (macOS) |
|
|
|
|
### Create or Modify System Process (T1543)
|
|
| Sub-Technique | Name |
|
|
|---------------|------|
|
|
| T1543.003 | Windows Service |
|
|
| T1543.004 | Launch Daemon (macOS/Linux) |
|
|
|
|
### Scheduled Task/Job (T1053)
|
|
| Sub-Technique | Name |
|
|
|---------------|------|
|
|
| T1053.005 | Scheduled Task |
|
|
| T1053.003 | Cron |
|
|
| T1053.002 | At |
|
|
|
|
### Event Triggered Execution (T1546)
|
|
| Sub-Technique | Name |
|
|
|---------------|------|
|
|
| T1546.001 | Change Default File Association |
|
|
| T1546.002 | Screensaver |
|
|
| T1546.003 | WMI Event Subscription |
|
|
| T1546.004 | Unix Shell Configuration Modification |
|
|
| T1546.007 | Netsh Helper DLL |
|
|
| T1546.008 | Accessibility Features (sethc, utilman, narrator) |
|
|
| T1546.010 | AppInit DLLs |
|
|
| T1546.011 | Application Shimming |
|
|
| T1546.012 | Image File Execution Options Injection |
|
|
| T1546.013 | PowerShell Profile |
|
|
| T1546.015 | COM Hijacking |
|
|
| T1546.016 | Installer Packages |
|
|
|
|
### Hijack Execution Flow (T1574)
|
|
| Sub-Technique | Name |
|
|
|---------------|------|
|
|
| T1574.001 | DLL Search Order Hijacking |
|
|
| T1574.002 | DLL Side-Loading |
|
|
| T1574.006 | Dynamic Linker Hijacking |
|
|
| T1574.008 | Path Interception by Search Order Hijacking |
|
|
| T1574.009 | Path Interception by Unquoted Service Path |
|
|
| T1574.011 | Services Registry Permissions Weakness |
|
|
| T1574.012 | COR_PROFILER |
|
|
|
|
## Key Registry Persistence Locations
|
|
|
|
```
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
|
|
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
|
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
|
|
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
|
|
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
|
|
HKLM\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32
|
|
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
|
|
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
|
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
|
|
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
|
|
```
|
|
|
|
## Detection Event IDs
|
|
|
|
| Source | Event ID | Meaning |
|
|
|--------|----------|---------|
|
|
| Sysmon | 12 | Registry object created/deleted |
|
|
| Sysmon | 13 | Registry value set |
|
|
| Sysmon | 14 | Registry object renamed |
|
|
| Sysmon | 19 | WMI EventFilter created |
|
|
| Sysmon | 20 | WMI EventConsumer created |
|
|
| Sysmon | 21 | WMI ConsumerToFilter binding |
|
|
| Windows Security | 4697 | Service installed |
|
|
| Windows Security | 4698 | Scheduled task created |
|
|
| Windows Security | 4699 | Scheduled task deleted |
|
|
| Windows Security | 7045 | New service installed |
|
|
| Task Scheduler | 106 | Task registered |
|
|
| Task Scheduler | 140 | Task updated |
|