SignalHunt
← All rules

SYS-4005

high

Registry Run Key Modified for Persistence

Detects a value being set under a Run/RunOnce registry key - the classic registry-based persistence mechanism, causing a program to execute automatically at user logon.

T1547.001

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 13,
    "EventType": "SetValue",
    "TargetObject|contains": "\\CurrentVersion\\Run"
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 13

Required log fields

  • TargetObject
  • Details
  • Image

Enabling this in your environment

Where: Sysmon configuration - RegistryEvent (Event ID 13), scoped to Run/RunOnce key paths.

sysmon64.exe -c sysmonconfig.xml

Registry event volume is high system-wide; scope the config to the specific Run/RunOnce/Services key paths that matter for persistence detection rather than logging all registry writes.

False positives

  • Legitimate software (chat clients, sync tools, driver utilities) registering itself to run at startup during installation

References