Situational AwarenessTTPCAR-2013-01-002

Autorun Differences

Hypothesis and description

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

Utilizes the Sysinternals autoruns tool (ignoring validated Microsoft entries). Primarily not a detection analytic by itself but through analysis of results by an analyst can be used for such. Building another analytic on top of this one identifying unusual entries would likely be a beneficial alternative.

Platforms: Windows
Domain: Analytic, Host
Subtypes: Registry
Submitted: 2013-01-25
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1543 Create or Modify System ProcessT1543.003	Persistence	Moderate
T1053 Scheduled Task/JobT1053.005	Persistence	Moderate
T1547 Boot or Logon Autostart ExecutionT1547.001, T1547.010, T1547.004	Persistence	Moderate
T1574 Hijack Execution FlowT1574.007, T1574.008, T1574.009, T1574.010, T1574.011	Persistence, Privilege Escalation	Moderate
T1546 Event Triggered ExecutionT1546.001, T1546.003, T1546.008, T1546.010	Privilege Escalation, Persistence	Moderate
T1112 Modify Registry	Persistence, Execution	Moderate
T1037 Boot or Logon Initialization ScriptsT1037.001	Persistence	Moderate

7 techniques, 22 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-SICA System Init Config Analysis

Across MITRE's defensive frameworks

Linked through the 7 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

45 more in the full list

View CAR-2013-01-002 on car.mitre.org