Anthropic-Cybersecurity-Skills/skills/hunting-for-registry-persistence-mechanisms/references/standards.md

Standards and References - Hunting For Registry Persistence Mechanisms

MITRE ATT&CK Mappings

Technique	Name	Description
T1547.001	Registry Run Keys	See attack.mitre.org/techniques/T1547/001
T1547.004	Winlogon Helper DLL	See attack.mitre.org/techniques/T1547/004
T1546.012	IFEO Injection	See attack.mitre.org/techniques/T1546/012
T1546.015	COM Hijacking	See attack.mitre.org/techniques/T1546/015

Detection Data Sources

Source	Event ID	Purpose
Sysmon	1	Process creation with command line
Sysmon	3	Network connection initiated
Sysmon	7	Image loaded (DLL)
Sysmon	10	Process access (LSASS)
Sysmon	11	File creation
Sysmon	12/13	Registry create/set
Sysmon	22	DNS query
Sysmon	25	Process tampering
Windows Security	4624	Successful logon
Windows Security	4625	Failed logon
Windows Security	4648	Explicit credential logon
Windows Security	4672	Special privileges assigned
Windows Security	4688	Process creation
Windows Security	4697	Service installed
Windows Security	4698	Scheduled task created
Windows Security	4769	Kerberos TGS requested
Windows Security	5140	Network share accessed

References

• MITRE ATT&CK Framework: https://attack.mitre.org/
• Sigma Detection Rules: https://github.com/SigmaHQ/sigma
• LOLBAS Project: https://lolbas-project.github.io/
• Atomic Red Team Tests: https://github.com/redcanaryco/atomic-red-team
• Red Canary Threat Detection Report
• SANS Threat Hunting Summit Resources