Analytics Story: Windows Persistence Techniques

Date: 2018-05-31 ID: 30874d4f-20a1-488f-85ec-5d52ef74e3f9 Author: Bhavin Patel, Splunk Product: Splunk Enterprise Security

Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.

Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.

Name ▲▼ Technique ▲▼ Type ▲▼
Active Setup Registry Autostart Active Setup TTP
Certutil exe certificate extraction None TTP
Detect Path Interception By Creation Of program exe Path Interception by Unquoted Path TTP
ETW Registry Disabled Trusted Developer Utilities Proxy Execution, Indicator Blocking TTP
Hiding Files And Directories With Attrib exe Windows File and Directory Permissions Modification TTP
Logon Script Event Trigger Execution Logon Script (Windows) TTP
Monitor Registry Keys for Print Monitors Port Monitors TTP
Print Processor Registry Autostart Print Processors TTP
Reg exe Manipulating Windows Services Registry Keys Services Registry Permissions Weakness TTP
Registry Keys for Creating SHIM Databases Application Shimming TTP
Registry Keys Used For Persistence Registry Run Keys / Startup Folder TTP
Sc exe Manipulating Windows Services Windows Service TTP
Schedule Task with HTTP Command Arguments Scheduled Task/Job TTP
Schedule Task with Rundll32 Command Trigger Scheduled Task/Job TTP
Scheduled Task Deleted Or Created via CMD Scheduled Task TTP
Schtasks used for forcing a reboot Scheduled Task TTP
Screensaver Event Trigger Execution Screensaver TTP
Shim Database File Creation Application Shimming TTP
Shim Database Installation With Suspicious Parameters Application Shimming TTP
Suspicious Scheduled Task from Public Directory Scheduled Task Anomaly
Time Provider Persistence Registry Time Providers TTP
Windows AD DSRM Account Changes Account Manipulation TTP
Windows AD Same Domain SID History Addition SID-History Injection TTP
Windows Compatibility Telemetry Suspicious Child Process Event Triggered Execution, Scheduled Task TTP
Windows Compatibility Telemetry Tampering Through Registry Event Triggered Execution, Scheduled Task TTP
Windows Event Triggered Image File Execution Options Injection Image File Execution Options Injection Hunting
Windows Mshta Execution In Registry Mshta TTP
Windows New Default File Association Value Set Change Default File Association Hunting
Windows Registry Delete Task SD Scheduled Task, Impair Defenses Anomaly
Windows Scheduled Task Service Spawned Shell Scheduled Task, Command and Scripting Interpreter TTP
Windows Scheduled Task with Suspicious Command Scheduled Task TTP
Windows Scheduled Task with Suspicious Name Scheduled Task TTP
Windows Schtasks Create Run As System Scheduled Task TTP
Windows Service Creation Using Registry Entry Services Registry Permissions Weakness Anomaly
WinEvent Scheduled Task Created to Spawn Shell Scheduled Task TTP
WinEvent Scheduled Task Created Within Public Path Scheduled Task TTP
WinEvent Windows Task Scheduler Event Action Started Scheduled Task Hunting
Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
CrowdStrike ProcessRollup2 N/A crowdstrike:events:sensor crowdstrike
Sysmon EventID 1 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 11 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 12 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Windows Event Log Application 3000 Windows icon Windows XmlWinEventLog XmlWinEventLog:Application
Windows Event Log Security 4688 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4698 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4700 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4702 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4738 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4742 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log TaskScheduler 200 Windows icon Windows wineventlog WinEventLog:Microsoft-Windows-TaskScheduler/Operational
Windows Event Log TaskScheduler 201 Windows icon Windows xmlwineventlog XmlWinEventLog:Security

Source: GitHub | Version: 2