detection.wiki

Detection rules › Sigma

Shell Open Registry Keys Manipulation

Severity
high
Author
Christian Burkard (Nextron Systems)
Source
upstream

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.001 Event Triggered Execution: Change Default File Association
Privilege EscalationT1546.001 Event Triggered Execution: Change Default File Association, T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Defense EvasionT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: selection1

Details|contains: '\Software\Classes\{'
EventType: SetValue
TargetObject|endswith: 'Classes\ms-settings\shell\open\command\SymbolicLinkValue'

Stage 2: selection2

TargetObject|endswith: 'Classes\ms-settings\shell\open\command\DelegateExecute'

Stage 3: selection3

or:
TargetObject|endswith: 'Classes\exefile\shell\open\command\(Default)'
TargetObject|endswith: 'Classes\ms-settings\shell\open\command\(Default)'
EventType: SetValue

Stage 4: not filter_sel3

Details: '(Empty)'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailseq
  • (Empty) corpus 24 (sigma 24)
Detailsmatch
  • \Software\Classes\{
EventTypeeq
  • SetValue corpus 3 (sigma 3)
TargetObjectends_with
  • Classes\exefile\shell\open\command\(Default)
  • Classes\ms-settings\shell\open\command\(Default)
  • Classes\ms-settings\shell\open\command\DelegateExecute
  • Classes\ms-settings\shell\open\command\SymbolicLinkValue