# data[].attributes.body
https://youtu.be/LJXjEP9vIaY

Workshops threatening hunting
https://samsclass.info/workshops.htm#BOTS

Keynote: Cobalt Strike Threat Hunting | Chad Tilbury

https://www.youtube.com/watch?v=borfuQGrB8g

Blog Splunk
https://hurricanelabs.com/splunk-tutorials/threat-hunting-with-splunk-part-2-process-creation-log-analysis/

Basic
https://www.splunk.com/en_us/blog/security/hunting-with-splunk-the-basics.html

# data[].attributes.attachment_link.title
Threat Hunting Tutorial- Day 6, APT39 Hunting using Splunk

# data[].attributes.body
https://github.com/0xpat/0xpat.github.io/blob/master/_posts/2020-04-06-Malware_development_part_3.md

https://github.com/kymb0/Malware_learns/tree/main/sektor7_malware_dev

# data[].attributes.attachment_link.readable_text
Hello, cybersecurity enthusiasts and white hackers!

This post starts a series of articles on windows malware persistence techniques and tricks.

Today I'll wrote about the result of self-researching "classic" persistence trick: startup folder registry keys.

run keys

Adding an entry to the "run keys" in the registry will cause the app referenced to be executed when a user logs in. These apps will be executed under the context of the user and will have the account's associated permissions level.

The following run keys are created by default on Windows Systems:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Please note that this suggests to another trick to anti-VM (VirtualBox)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Threat actors can use these configuration locations to execute malware to maintain persistence through system reboots. Threat actors may also use masquerading to make the registry entries look as if they are associated with legitimate programs.

practical example

Let's go to look at a practical example. Let's say we have a "malware" hack.cpp:

Let's go to compile it:

And save it to folder Z:\\2022-04-20-malware-pers-1\:

Then, let's create a script pers.cpp that creates registry keys that will execute our program hack.exe when we log into Windows:

As you can see, logic is simplest one. We just add new registry key. Registry keys can be added from the terminal to the run keys to achieve persistence, but since I love to write code, I wanted to show how to do it with some lines of code.

demo

Let's compile our pers.cpp script:

Then, first of all, check registry keys in the victim's machine:

Then, run our pers.exe script and check again:

As you can see, new key added as expected.
So now, check everything in action. Logout and login again:

Pwn! Everything is worked perfectly :)

After the end of the experiment, delete the keys:

windows 11

This trick is also work on Windows 11:

And cleanup:

conclusion

Creating registry keys that will execute an malicious app during Windows logon is one of the oldest tricks in the red team playbooks. Various threat actors and known tools such as Metasploit, Powershell Empire provide this capability therefore a mature blue team specialists will be able to detect this malicious activity.

RegOpenKeyEx
RegSetValueEx
RegCloseKey
Remove-ItemProperty
reg query
source code in github

This is a practical case for educational purposes only.

Thanks for your time happy hacking and good bye!
PS. All drawings and screenshots are mine

# data[].attributes.attachment_link.title
Malware development: persistence - part 1. Registry run keys. C++ example.

# data[].attributes.attachment_link.description
Hello, cybersecurity enthusiasts and white hackers! This post starts a series of articles on windows malware persistence techniques and tricks. Today I'll wrote about the result of self-researching "classic" persistence trick: startup folder registry keys. Adding an entry to the "run keys" in the registry will cause the app referenced to be executed when a user logs in.

# data[].attributes.body
https://github.com/archanchoudhury/Threat-Hunting/tree/main/Hunting-with-Splunk/Hunting-Process-Creation

# data[].attributes.attachment_link.description
SANS' blog is the place to share and discuss timely cybersecurity industry topics. Our blog posts include up-to-date contributions from well rounded experts in the field.

# data[].attributes.body
lab defenders
https://cyberdefenders.org/blueteam-ctf-challenges/15

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_main.htm

Red Team

https://www.ired.team/offensive-security/red-team-infrastructure

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics_aggressor-scripts/as_data-model.htm

# data[].attributes.attachment_link.readable_text
/var/log/messages

Like all good researchers, we publish our findings for everyone's benefit. The articles here evidence our commitment to technical excellence and the breadth of the disciplines we cover.

# data[].attributes.attachment_link.description
Like all good researchers, we publish our findings for everyone's benefit. The articles here evidence our commitment to technical excellence and the breadth of the disciplines we cover.