Port Monitor added in Registry

BIOC Low

Port Monitor added in Registry

Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)

Indicator:

Registry registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Monitors\ART AND action type = set_registry_value Host host os = windows

Preventable: yes