Threat Hunting Exercise: Analyzing Windows Registry Run Key + Startup Folder Dual Persistence Dataset
This hunt uses a simulated endpoint dataset (windows_dual_persist_2022-08-10T080000.json) capturing T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder, where an attacker plants redundant persistence mechanisms - a Run key and a Startup folder shortcut - pointing to the same or complementary payloads, so removal of one alone fails to evict the implant.
Step 1: Hypothesis Formation
Hypothesis: Two independent autostart mechanisms are created within a short window on the same host, both referencing scripts/binaries in non-standard locations, indicating deliberate persistence redundancy rather than a single legitimate installer action. Indicators:
- A new value is added under
HKCU\Software\Microsoft\Windows\CurrentVersion\Runor theHKLMequivalent, pointing to a script interpreter with an encoded argument. - A
.lnkfile is created in the user's or All Users Startup folder within minutes of the registry write. - Both point to payloads dropped in the same non-standard directory (e.g.,
%APPDATA%\Adobe\, mimicking a legitimate vendor folder). - Neither artifact corresponds to a known, digitally-signed application installer logged around the same time.
Null Hypothesis: A legitimate application installer (e.g., a chat client, VPN agent, or update tool) commonly creates both a Run key and a Startup shortcut as part of its normal installation. Invalidate by checking Add/Remove Programs, the MSI/installer log, and digital signature of the referenced binary.
Rationale: Attackers increasingly plant multiple persistence mechanisms so that an analyst removing the "obvious" one (often the Startup shortcut, which is visually inspectable) leaves the registry-based one intact; this hunt validates correlating both artifact types within a time window as a way to catch the full persistence set, not just the most visible piece.
Step 2: Data Sources and Scope
- Sources: Sysmon Event ID 13 (Registry Value Set) and 11 (File Create) for
.lnkfiles; EDR autoruns/persistence inventory; Windows Security Event 4688 (process creation for the installer). - Scope: ~2022-08-10T08:00:00-08:05:00 UTC; Host: WKS-SALES-019 (10.180.2.33); User: m.chen.
- SIEM Queries (Splunk/ELK):
index=sysmon EventCode=13 TargetObject="CurrentVersion\\Run" | table _time Computer TargetObject Detailsindex=sysmon EventCode=11 TargetFilename="\\Startup\\.lnk" | table _time Computer TargetFilename- Correlation window:
... | transaction Computer maxspan=10m startswith(EventCode=13) endswith(EventCode=11)
Step 3: Key Findings
Parsed events (5 shown) confirm a Run key and a Startup folder shortcut were created 90 seconds apart, both referencing payloads in a spoofed "Adobe" folder under AppData.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-10 08:00:12 | WKS-SALES-019 | Sysmon 11 - File Create | %APPDATA%\Adobe\ARMHelper\svchelper.vbs written | Masquerade IOC: mimics Adobe's legitimate ARM (Adobe Reader and Acrobat Manager) helper folder naming, but is not signed or installed via the real Adobe installer. |
| 2022-08-10 08:00:15 | WKS-SALES-019 | Sysmon 13 - Registry Set | HKCU\...\Run\AdobeARMHelper = wscript.exe //B %APPDATA%\Adobe\ARMHelper\svchelper.vbs | Registry Persistence IOC: Run key added referencing the just-dropped script, disguised with a plausible-looking value name. |
| 2022-08-10 08:01:40 | WKS-SALES-019 | Sysmon 11 - File Create | %APPDATA%\...\Startup\AdobeUpdateCheck.lnk created, target: same svchelper.vbs | Redundancy IOC: a second, independent autostart mechanism created within 90 seconds pointing to the identical payload - deliberate persistence redundancy. |
| 2022-08-10 08:02:00 | WKS-SALES-019 | (installer check) | No matching entry in Add/Remove Programs or MSI installer log for any Adobe product | Confirms no legitimate Adobe installation occurred around this time. |
| 2022-08-10 08:02:10 | WKS-SALES-019 | (signature check) | svchelper.vbs is an unsigned script; parent process of both writes was outlook.exe (email attachment execution) | Delivery IOC: both persistence mechanisms were planted directly from an opened email attachment, not an installer. |
Validation:
- Timeline: script drop, Run key, and Startup shortcut all within 90 seconds, sourced from an email attachment - consistent with a phishing-delivered persistence toolkit, not organic software installation.
- False Positives: no installer, MSI log, or Add/Remove Programs entry corresponds to this activity; the referenced script is unsigned despite mimicking a well-known vendor's naming convention.
- Correlation: dual autostart mechanisms pointing to the same payload, both traced to the same email-attachment execution - high confidence intentional persistence.
Step 4: Recommendations & Next Steps
- Immediate Response: Remove both the
AdobeARMHelperRun key and theAdobeUpdateCheck.lnkStartup shortcut; quarantinesvchelper.vbs; identify and block the originating phishing email/sender across the mail gateway; scan for the same folder/naming pattern fleet-wide. - Detection: Sigma-style rule:
title: Dual Autostart Persistence - Run Key and Startup Folder Within Short Window→selection: (EventID=13 AND TargetObject="\\Run\\") followed by (EventID=11 AND TargetFilename="\\Startup\\.lnk") within 10m, same host. - Pro Tip: Don't stop remediation at the first persistence artifact you find - always run a full autoruns comparison (registry + Startup folders + scheduled tasks + services) on any host with confirmed compromise, since redundant persistence is now a standard commodity-malware practice.
Hypothesis confirmed - a phishing attachment planted two independent, coordinated persistence mechanisms (a Run key and a Startup shortcut) disguised as Adobe components to survive removal of either one alone!