skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-registry-run-key-persistence

Detect registry Run key persistence by analyzing Sysmon Event ID 13 logs.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#sysmon#mitre att&ck#detection engineering#Windows forensics#t1547.001#registry persistence
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-registry-run-key-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-registry-run-key-persistence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-registry-run-key-persistence
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-registry-run-key-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adversaries commonly abuse Windows registry Run keys (MITRE ATT&CK T1547.001) to maintain persistence, and manually reviewing registry modifications across Sysmon logs is slow and error-prone. This Skill provides a structured hunting procedure to identify malicious auto-start entries before attackers entrench themselves.

Core Features & Use Cases

  • Sysmon Event ID 13 Analysis: Parse registry value-set events for TargetObject, Details, and Image fields to spot suspicious Run/RunOnce key modifications.
  • Malicious Pattern Detection: Flag values pointing to temp directories, encoded PowerShell commands, and LOLBin abuse such as mshta.exe, rundll32.exe, and regsvr32.exe.
  • Event Correlation: Chain Event ID 13 with Event ID 1 (Process Creation) and Event ID 11 (FileCreate) to confirm payload creation and execution.
  • Use Case: A SOC analyst investigating a compromised workstation uses this Skill to hunt for persistence entries, producing a JSON report with MITRE ATT&CK mapping, severity scores, and ready-to-deploy Sigma/Splunk detection rules.

Quick Start

Analyze the collected Sysmon Event ID 13 logs for suspicious registry Run key persistence entries and generate a detection report with Sigma rules.

Frequently Asked Questions about hunting-for-registry-run-key-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect registry Run key persistence with Sysmon?▼

Monitor Sysmon Event ID 13 (RegistryEvent - Value Set) filtered for Run and RunOnce key paths. Parse TargetObject, Details, and Image fields to flag values pointing to temp directories, encoded PowerShell, or LOLBins like mshta.exe and rundll32.exe.

What Sysmon event ID logs registry modifications?▼

Sysmon Event ID 13 logs registry value set operations, capturing the target object path, the new value written, and the process that made the change. Your Sysmon config must include RegistryEvent rules covering the Run key paths for events to be generated.

Why am I missing Sysmon Event ID 13 logs for Run keys?▼

Event ID 13 only fires for paths included in your Sysmon RegistryEvent configuration rules. Verify coverage of HKLM and HKCU Run, RunOnce, RunOnceEx, Policies\Explorer\Run, and Wow6432Node variants, since partial configs are the dominant cause of false negatives.

Can attackers persist in the registry without creating files?▼

Yes. Encoded PowerShell, mshta http, or rundll32 commands written directly into a Run key value leave no Event ID 11 FileCreate trace. Detection must focus on the registry value content itself rather than relying on file creation chaining.

How do I reduce false positives when hunting Run key persistence?▼

Baseline legitimate auto-start entries such as OneDrive, Teams, Spotify, and vendor updaters by their signed image and expected value string. Compare new detections against this known-good baseline before escalating.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
jmaglyjmagly
175

sigma-hunting

Apply Sigma detection rules to log sources and convert them to Elasticsearch, Splunk, and grep queries.

Community
Advanced
MHaggisMHaggis
471

Custom Atomics Deployment

Create, deploy, and execute custom Atomic Red Team YAML tests.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-windows-registry-for-artifacts

Extracts Windows registry artifacts from SAM, SYSTEM, SOFTWARE, NTUSER.DAT, and UsrClass.dat hives.

Community
Advanced