Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path

Alerts on Windows registry key additions matching a Ursnif-associated TargetObject path.

FreeReviewedSigma · High · v5

Product: windows
Category: registry_add
Author: megan201296 (SigmaHQ), DRL 1.1
Published: 2019-02-13
Updated: 2026-07-31

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry additions targeting a specific AppDataLow path associated with potential Ursnif malware activity. Attackers may use registry modifications to establish persistence or influence execution in a user context. Detection relies on Windows telemetry for registry_add events capturing the TargetObject value that ends with the specified GUID-like subpath.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Suspicious Registry Value under Console WindowsUpdates for C2 Storage

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

Suspicious Rootkit Configuration Registry Keys (via registry_set)

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path

Pivot detection · T1112 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

ursnif-related-registry-key-creation-indicators-on-windows-21f17060

title: Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path
id: 4d3a7fc0-7f91-495c-9a64-a660f5447dba
status: test
description: This rule flags Windows registry additions targeting a specific AppDataLow path associated with potential Ursnif malware activity. Attackers may use registry modifications to establish persistence or influence execution in a user context. Detection relies on Windows telemetry for registry_add events capturing the TargetObject value that ends with the specified GUID-like subpath.
references:
  - https://blog.yoroi.company/research/ursnif-long-live-the-steganography/
  - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/registry_add_malware_ursnif.yml
author: megan201296, Huntrule Team
date: 2019-02-13
modified: 2025-10-22
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_add
detection:
  selection:
    TargetObject|endswith: \Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 21f17060-b282-4249-ade0-589ea3591558
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL