huntrule

Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Flags HKCU DelegateExecute registry changes for COM hijack style persistence under the Folder shell open command.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Omkar Gudhate (SigmaHQ), DRL 1.1
Published
2020-09-27
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies registry set activity that changes the COM hijack persistence path under HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute. Attackers use DelegateExecute values to redirect how Windows components invoke commands, often supporting privilege escalation or bypassing intended execution flows. It relies on telemetry that records registry value writes and matches events whose TargetObject contains the specified DelegateExecute registry path.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Suspicious Python Path Configuration Hook Persistence (via file_event)
Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)
Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)
Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)
Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)
Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)
Suspicious Sang Loader Execution with Install or PassUAC Arguments
Possible GTFOBins Shell Breakout via Unix Utilities
Suspicious NetworkManager Dispatcher Script Persistence
Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)
Pivot detection · T1548 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.