Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Flags HKCU DelegateExecute registry changes for COM hijack style persistence under the Folder shell open command.

FreeUnreviewedSigmahighv1

windows-com-hijack-by-registry-delegateexecute-modification-hkcu-classes-folder--07743f65

title: Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)
id: 4020270e-983d-4320-b53f-abebc8e60609
status: test
description: This rule identifies registry set activity that changes the COM hijack persistence path under HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute. Attackers use DelegateExecute values to redirect how Windows components invoke commands, often supporting privilege escalation or bypassing intended execution flows. It relies on telemetry that records registry value writes and matches events whose TargetObject contains the specified DelegateExecute registry path.
references:
  - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass
  - https://www.exploit-db.com/exploits/47696
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml
author: Omkar Gudhate, Huntrule Team
date: 2020-09-27
modified: 2023-09-28
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546
  - attack.t1548
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Classes\Folder\shell\open\command\DelegateExecute
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 07743f65-7ec9-404a-a519-913db7118a8d
    type: derived

What it detects

This rule identifies registry set activity that changes the COM hijack persistence path under HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute. Attackers use DelegateExecute values to redirect how Windows components invoke commands, often supporting privilege escalation or bypassing intended execution flows. It relies on telemetry that records registry value writes and matches events whose TargetObject contains the specified DelegateExecute registry path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.