Suspicious Shell Open Command Registry Change (via registry_set)

title: Suspicious Shell Open Command Registry Change (via registry_set)
id: 9b69ff61-aed9-593a-82fd-726f254a1431
status: stable
description: This rule detects modifications to shell open registry keys that point to anomalous locations usually used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence methods involve modifying these keys to execute hostile scripts or binaries.
references:
    - https://attack.mitre.org/techniques/T1546/001/
    - https://attack.mitre.org/techniques/T1548/002/
    - https://www.trendmicro.com/en_us/research/25/f/water-curse.html
author: Huntrule Team
date: 2026-03-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.002
    - attack.t1546.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\shell\open\command\'
        Details|contains:
            - '\$Recycle.Bin\'
            - '\AppData\Local\Temp\'
            - '\Contacts\'
            - '\Music\'
            - '\PerfLogs\'
            - '\Photos\'
            - '\Pictures\'
            - '\Users\Public\'
            - '\Videos\'
            - '\Windows\Temp\'
            - '%AppData%'
            - '%LocalAppData%'
            - '%Temp%'
            - '%tmp%'
    condition: selection
falsepositives:
    - Unknown
level: medium