Detection rules › Sigma

User Shell Folders Registry Modification via CommandLine

Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege EscalationT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Defense EvasionT1112 Modify Registry

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\reg.exe'
OriginalFileName: powershell.exe
OriginalFileName: pwsh.dll
OriginalFileName: reg.exe

Stage 2: all of selection_cli_action

or:
CommandLine|contains: ' add '
CommandLine|contains: New-ItemProperty
CommandLine|contains: Set-ItemProperty
CommandLine|contains: 'si '

Stage 3: all of selection_cli_paths_root

or:
CommandLine|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders'
CommandLine|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'

Stage 4: all of selection_cli_paths_suffix

CommandLine|contains: Startup

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • add corpus 11 (sigma 11)
  • New-ItemProperty corpus 4 (sigma 4)
  • Set-ItemProperty corpus 4 (sigma 4)
  • Startup
  • \Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
  • \Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  • si corpus 4 (sigma 4)
Imageends_with
  • \powershell.exe corpus 143 (sigma 143)
  • \pwsh.exe corpus 140 (sigma 140)
  • \reg.exe corpus 46 (sigma 46)
OriginalFileNameeq
  • powershell.exe corpus 8 (sigma 8)
  • pwsh.dll corpus 72 (sigma 68, splunk 4)
  • reg.exe corpus 29 (sigma 29)