Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Flags HKCU DelegateExecute registry changes for COM hijack style persistence under the Folder shell open command.

FreeReviewedSigma · High · v1

Product: windows
Category: registry_set
Author: Omkar Gudhate (SigmaHQ), DRL 1.1
Published: 2020-09-27
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546Event Triggered Execution
Priv Esc
- T1546Event Triggered Execution
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies registry set activity that changes the COM hijack persistence path under HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute. Attackers use DelegateExecute values to redirect how Windows components invoke commands, often supporting privilege escalation or bypassing intended execution flows. It relies on telemetry that records registry value writes and matches events whose TargetObject contains the specified DelegateExecute registry path.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Malicious Azure Elevate Access to User Access Administrator

Suspicious User Home Directory Modification via dscl Process Creation

Possible GTFOBins Shell Breakout via apt Command

AdminSDHolder Permissions Changed for Persistence (via security)

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Malicious macOS Credential Verification via dscl authonly

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Pivot detection · T1548 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-com-hijack-by-registry-delegateexecute-modification-hkcu-classes-folder--07743f65

title: Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)
id: 4020270e-983d-4320-b53f-abebc8e60609
status: test
description: This rule identifies registry set activity that changes the COM hijack persistence path under HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute. Attackers use DelegateExecute values to redirect how Windows components invoke commands, often supporting privilege escalation or bypassing intended execution flows. It relies on telemetry that records registry value writes and matches events whose TargetObject contains the specified DelegateExecute registry path.
references:
  - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass
  - https://www.exploit-db.com/exploits/47696
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml
author: Omkar Gudhate, Huntrule Team
date: 2020-09-27
modified: 2023-09-28
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546
  - attack.t1548
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Classes\Folder\shell\open\command\DelegateExecute
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 07743f65-7ec9-404a-a519-913db7118a8d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL