Title:Potential Persistence Via AppCompat RegisterAppRestart Layer Status:test Description:Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.
This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API.
This can be potentially abused as a persistence mechanism.
References: -https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md Author: Nasreddine Bencherchali (Nextron Systems) Date: 2024-01-01 modified:None Tags:
-'attack.privilege-escalation'
-'attack.persistence'
-'attack.t1546.011'
Logsource:
category: registry_set
product: windows
Detection: selection: TargetObject|contains:
'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\' Details|contains:
'REGISTERAPPRESTART' condition:selection Falsepositives:
-Legitimate applications making use of this feature for compatibility reasons Level:medium
