Active Setup Registry Key Used for Persistence
This rule detects network traffic patterns indicative of an attempt to use the 'Active Setup' registry key for persistence. Specifically, it looks for TCP traffic on port 445 (commonly used for SMB/CIFS) directed to the home network, containing the strings 'Active Setup' and 'StubPath' (case-insensitive). This combination suggests an attacker might be trying to establish persistence by modifying the 'StubPath' value within an 'Active Setup' registry key, which Windows uses to run commands during user logon.
Suricata
