Lion Cipher Lab
Hunt registry persistence in Sysmon registry events (Event IDs 12-14)
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
The Windows registry is where most persistence lives. A single value under a Run key starts a program at every logon; a Debugger value under Image File Execution Options swaps a system tool for a backdoor; a per-user COM entry quietly loads an attacker's DLL into Explorer. Sysmon records every one of those writes -- and also every write by every installer, updater and chat app on the fleet, which is thousands of harmless events a week. An analyst who alerts on 'something wrote to a Run key' is paged all day and learns to ignore the pager. This lab teaches the two moves that work in practice:…
What you'll learn
- Reading Sysmon registry events (Event IDs 12, 13, 14): EventType, Image, TargetObject, Details, and the HKU / HKCR abbreviations Sysmon uses
- Knowing six registry autostart families attackers use and the ATT&CK technique for each (T1547.001, T1547.004, T1546.012, T1546.010, T1547.005, T1546.015)
- Spotting a per-user COM hijack: an HKCU class that shadows a machine-wide CLSID in the merged HKEY_CLASSES_ROOT view
- Writing per-family detection logic (who wrote the value, what the value points at) and measuring precision and recall per key family
- Stacking normalised (key, value-data) pairs across a fleet to find the rare rows a rule misses
- Naming what registry telemetry cannot see (offline hive edits, unconfigured keys, values written by trusted installers)
Steps in this lab
- What registry persistence is, and why you hunt it in telemetry
- The six key families you will watch
- How Sysmon records a registry write
- Build a week of registry events for 40 hosts
- Why 'alert on any write to an autostart key' fails
- Score three rules, family by family
- Read every false positive and the one miss
- Stack the fleet: the row that exists on one machine
- Optional: look at your own machine (read-only)
- Honest limits, and what sits in front of this
- Where this goes next