Potential Persistence Using DebugPath

Title: Potential Persistence Using DebugPath
Status: test
Description:Detects potential persistence using Appx DebugPath
References:
  -https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
  -https://github.com/rootm0s/WinPwnage
Author: frack113
Date: 2022-07-27
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.015'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection_debug:
    TargetObject|contains: 'Classes\ActivatableClasses\Package\Microsoft.'
    TargetObject|endswith: '\DebugPath'
  selection_default:
    TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.'
    TargetObject|endswith: '\(Default)'
  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: medium