Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path
Alerts on Windows registry key additions matching a Ursnif-associated TargetObject path.
- Product
- windows
- Category
- registry_add
- Author
- megan201296 (SigmaHQ), DRL 1.1
- Published
- 2019-02-13
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry additions targeting a specific AppDataLow path associated with potential Ursnif malware activity. Attackers may use registry modifications to establish persistence or influence execution in a user context. Detection relies on Windows telemetry for registry_add events capturing the TargetObject value that ends with the specified GUID-like subpath.
Reporting behind it
- blog.yoroi.companyhttps://blog.yoroi.company/research/ursnif-long-live-the-steganography/
- blog.trendmicro.comhttps://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/registry_add_malware_ursnif.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path
id: 4d3a7fc0-7f91-495c-9a64-a660f5447dba
status: test
description: This rule flags Windows registry additions targeting a specific AppDataLow path associated with potential Ursnif malware activity. Attackers may use registry modifications to establish persistence or influence execution in a user context. Detection relies on Windows telemetry for registry_add events capturing the TargetObject value that ends with the specified GUID-like subpath.
references:
- https://blog.yoroi.company/research/ursnif-long-live-the-steganography/
- https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/registry_add_malware_ursnif.yml
author: megan201296, Huntrule Team
date: 2019-02-13
modified: 2025-10-22
tags:
- attack.persistence
- attack.execution
- attack.defense-impairment
- attack.t1112
- detection.emerging-threats
logsource:
product: windows
category: registry_add
detection:
selection:
TargetObject|endswith: \Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 21f17060-b282-4249-ade0-589ea3591558
type: derived