Registry Persistence Mechanisms in Recycle Bin

Title: Registry Persistence Mechanisms in Recycle Bin
Status: test
Description:Detects persistence registry keys for Recycle Bin
References:
  -https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf
  -https://persistence-info.github.io/Data/recyclebin.html
  -https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
Author: frack113
Date: 2021-11-18
modified:2022-12-06
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection_create:
    EventType: 'RenameKey'
    NewName|contains: '\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open'
  selection_set:
    EventType: 'SetValue'
    TargetObject|contains: '\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default)'
  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: high