Detectionhightest
Registry Persistence via Explorer Run Key
Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems), oscd.communityCreated Wed Jul 18Updated Mon Dec 11b7916c2a-fa2f-4795-9477-32b731f70f11windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
Details|contains:
- ':\$Recycle.bin\'
- ':\ProgramData\'
- ':\Temp\'
- ':\Users\Default\'
- ':\Users\Public\'
- ':\Windows\Temp\'
- '\AppData\Local\Temp\'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Rule Metadata
Rule ID
b7916c2a-fa2f-4795-9477-32b731f70f11
Status
test
Level
high
Type
Detection
Created
Wed Jul 18
Modified
Mon Dec 11
Path
rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.t1547.001