Suspicious Run Key from Download

Title: Suspicious Run Key from Download
Status: test
Description:Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
References:
  -https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  -https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)
Date: 2019-10-01
modified:2025-02-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.001'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    Image|contains:
      -'\AppData\Local\Packages\Microsoft.Outlook_'
      -'\AppData\Local\Microsoft\Olk\Attachments\'
      -'\Downloads\'
      -'\Temporary Internet Files\Content.Outlook\'
      -'\Local Settings\Temporary Internet Files\'

    TargetObject|contains:
      -'\Software\Microsoft\Windows\CurrentVersion\Run'
      -'\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
      -'\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'

  condition:selection
Falsepositives:
  -Software installers downloaded and used by users
Level: high