Run Once Task Configuration in Registry

Title: Run Once Task Configuration in Registry
Status: test
Description:Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup
References:
  -https://twitter.com/pabraeken/status/990717080805789697
  -https://lolbas-project.github.io/lolbas/Binaries/Runonce/
Author: Avneet Singh @v3t0_, oscd.community
Date: 2020-11-15
modified:2024-03-25
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_event

Detection:
  selection:
    TargetObject|contains: '\Microsoft\Active Setup\Installed Components'
    TargetObject|endswith: '\StubPath'
  filter_optional_chrome:
    Details|contains|all:
      -'C:\Program Files\Google\Chrome\Application\'
      -'\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level'

  filter_optional_edge:
    Details|contains:
      -'C:\Program Files (x86)\Microsoft\Edge\Application\'
      -'C:\Program Files\Microsoft\Edge\Application\'

    Details|endswith: '\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Legitimate modification of the registry key by legitimate program
Level: medium