Persistence on Windows: overlooked locations in detection

// Introduction

Persistence mechanisms in Windows often evade detection, particularly in less-frequented locations. While common paths like Startup folders or the Run registry keys receive significant scrutiny, there are subtler areas that can serve as persistence vectors for attackers. This piece dissects those overlooked locations, helping defenders sharpen their focus.

// Registry Keys: The Hidden Threats

Registry keys can be a goldmine for attackers looking to maintain access. Beyond the well-known HKCU\Software\Microsoft\Windows\CurrentVersion\Run, consider these less-obvious entries:

• Startup Folder: C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• RunOnce Key: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
• Services: HKLM\SYSTEM\CurrentControlSet\Services

The RunOnce key is particularly interesting as it executes commands upon the next user login and then deletes the entry. To check for unusual entries, run:

Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce

// File System Locations

Attackers often place their payloads in less suspicious directories. Apart from the obvious paths, consider these folders:

• Temporary Folders: C:\Windows\Temp, C:\Users\<Username>\AppData\Local\Temp
• Program Files: If an attacker has admin access, they can place executables in C:\Program Files or C:\Program Files (x86).

To identify potentially malicious files in these directories, the following command can help:

Get-ChildItem -Path C:\Windows\Temp -Recurse | Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) }

This checks for any files created in the last week, which might indicate suspicious activity.

// Scheduled Tasks: A Persistent Vector

While many organizations audit scheduled tasks, they often overlook the potential for abuse. Check both user and system tasks:

• User Tasks: C:\Windows\System32\Tasks (user-specific tasks)
• System Tasks: C:\Windows\System32\Tasks\Microsoft\Windows

To view scheduled tasks, utilize:

Get-ScheduledTask | Where-Object { $_.State -eq 'Ready' }

Look for tasks with unusual actions, particularly those that execute scripts or unknown executables. An attacker may create a task that runs at a specific interval or event, maintaining persistence.

// Monitoring Event Logs

Event logs provide a wealth of information, yet many defenders fail to correlate logs effectively. Focus on:

• Event ID 4688: New process creation, revealing potential persistence mechanisms.
• Event ID 4697: A service was installed on the system, indicating possible manipulation.

To extract relevant logs, use:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Select-Object -Property TimeCreated, Message | Out-File C:\temp\ProcessCreationLogs.txt

Review the created logs for any unexpected entries.

// Mistakes to Avoid

Defenders often make several critical errors when searching for persistence mechanisms:

• Ignoring User Context: Many persistence techniques occur under user context. Focusing only on system-level entries can miss crucial indicators.
• Neglecting Older Entries: Some persistence methods may have been set long ago. Running periodic audits can unveil malicious payloads that have been overlooked.
• Assuming Visibility: Just because a location isn’t commonly used doesn’t mean it’s secure. Assume that all locations are potential targets.

// Defensive Implications

Understanding these overlooked areas allows defenders to create more comprehensive detection rules and monitoring strategies. Hardening these locations can involve:

• Regular audits of system and user registry keys.
• Monitoring changes in the C:\Windows\Temp and application directories.
• Establishing alerts for new scheduled tasks and unusual process creations.

// Checklist for Detection

When hunting for persistence mechanisms, keep this checklist handy: 1. Audit the Run and RunOnce registry keys. 2. Investigate non-standard file paths in Temp directories. 3. Examine both user and system scheduled tasks. 4. Monitor event logs for process creation and service installations. 5. Regularly review and update detection signatures based on findings.

// Conclusion

By focusing on these overlooked persistence locations, defenders can enhance their detection capabilities significantly. Regularly revisiting these areas and employing the right tools can help maintain a strong security posture. Remember, the techniques discussed here belong in a disposable range that you own, and DaemonCore Academy offers free resources to help you refine your skills further.