Introduction
During a cyber incident, evicting a threat actor from the network requires more than just terminating a malicious process. Sophisticated attackers aim to stay inside an infrastructure long after their initial foothold is gained. One of the most common ways they achieve this stealth longevity is through Windows Registry Persistence.
By altering specific registry keys, malware or web shells can be instructed to run automatically every time a system boots up or a user logs in. As security analysts, hunting down these unauthorized registry modifications is a fundamental priority. In this playbook, we will dive deep into how these backdoors operate and how to build high-fidelity Kusto Query Language (KQL) detections inside Microsoft Defender for Endpoint (MDE) to catch them in real-time.
The Mechanics of Registry Run Keys
Attackers frequently target standard Run and RunOnce registry paths. These keys are designed to launch legitimate software during startup, making them a perfect hiding place for malicious binaries. The two primary paths targeted are:
- User-Specific:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - System-Wide:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
When an incident response team overlooks these keys during remediation, the attacker simply waits for a system reboot to automatically regain a live command-and-control (C2) beacon, rendering the initial eviction effort useless.
The KQL Detection Playbook
To proactively hunt for this behavior across your enterprise, we look for registry modification events where the target path includes these specific execution keys.
Below is a production-ready KQL query designed to run in MDE's Advanced Hunting console. It surfaces registry changes pointing to unusual or unrecognized directories (like AppData or Public), which are heavily favored by threat actors attempting to evade detection:
