Run Once Task Execution as Configured in Registry

Title: Run Once Task Execution as Configured in Registry
Status: test
Description:This rule detects the execution of Run Once task as configured in the registry
References:
  -https://twitter.com/pabraeken/status/990717080805789697
  -https://lolbas-project.github.io/lolbas/Binaries/Runonce/
  -https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA
Author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)
Date: 2020-10-18
modified:2022-12-13
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\runonce.exe' Description:'Run Once Wrapper'   selection_cli:
CommandLine|contains:'/AlternateShellStartup' CommandLine|endswith:'/r'   condition:all of selection_*
Falsepositives:
  -Unknown
Level: low