First commit

[YousefNein]

Summary of the Pull Request

Changelog

Summary of the Pull Request

This pull request adds a new Sigma rule to detect persistence via modifications to the HKLM\Software\Microsoft\Command Processor\AutoRun registry key. The rule monitors both Sysmon Event ID 13 and Windows Event ID 4657 to identify suspicious modifications to the AutoRun registry value, which can be used for persistence as described in MITRE ATT&CK T1546 and demonstrated in Atomic Red Team's Atomic Test #2.

Changelog

new: Persistence via CommandProcessor AutoRun Registry Key

Example Log Event

Sysmon Event (Event ID 13)

Registry value set:
RuleName: -
EventType: SetValue
UtcTime: 2025-02-23 12:36:54.674
ProcessGuid: {689153b7-1663-67bb-9d06-000000002b00}
ProcessId: 7400
Image: C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
TargetObject: HKLM\SOFTWARE\Microsoft\Command Processor\AutoRun
Details: notepad.exe
User: VULN-WINDOWS11\robotnik

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @YousefNein 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃