Suspicious Shell Open Command Registry Modification

Severity: medium
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the *\shell\open\command registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.001` Event Triggered Execution: Change Default File Association
Privilege Escalation	`T1546.001` Event Triggered Execution: Change Default File Association, `T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

or:
Details|contains: '%AppData%'
Details|contains: '%LocalAppData%'
Details|contains: '%Temp%'
Details|contains: '%tmp%'
Details|contains: '\$Recycle.Bin\'
Details|contains: '\AppData\Local\Temp\'
Details|contains: '\Contacts\'
Details|contains: '\Music\'
Details|contains: '\PerfLogs\'
Details|contains: '\Photos\'
Details|contains: '\Pictures\'
Details|contains: '\Users\Public\'
Details|contains: '\Videos\'
Details|contains: '\Windows\Temp\'
TargetObject|contains: '\shell\open\command\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.