huntrule

Windows Command-Line Persistence via TypedPaths Registry Modification

Flags command-line activity referencing the Explorer TypedPaths registry path, which may indicate persistence via registry modification.

FreeUnreviewedSigmamediumv1
title: Windows Command-Line Persistence via TypedPaths Registry Modification
id: e444e9c2-e149-410f-bfad-83f565ab50b3
status: test
description: This rule matches process creation events where the command line contains the registry path for Explorer TypedPaths under the CurrentVersion key. Modifying TypedPaths can indicate an attempt to create or alter persistence behavior by changing how Explorer resolves typed path entries. Telemetry relies on Windows process creation logs with access to the full command line string.
references:
  - https://twitter.com/dez_/status/1560101453150257154
  - https://forensafe.com/blogs/typedpaths.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
tags:
  - attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba
    type: derived

What it detects

This rule matches process creation events where the command line contains the registry path for Explorer TypedPaths under the CurrentVersion key. Modifying TypedPaths can indicate an attempt to create or alter persistence behavior by changing how Explorer resolves typed path entries. Telemetry relies on Windows process creation logs with access to the full command line string.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.