Windows Command-Line Persistence via TypedPaths Registry Modification
Flags command-line activity referencing the Explorer TypedPaths registry path, which may indicate persistence via registry modification.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-22
- Updated
- 2026-07-30
What it detects
This rule matches process creation events where the command line contains the registry path for Explorer TypedPaths under the CurrentVersion key. Modifying TypedPaths can indicate an attempt to create or alter persistence behavior by changing how Explorer resolves typed path entries. Telemetry relies on Windows process creation logs with access to the full command line string.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-command-line-persistence-via-typedpaths-registry-modification-ec88289a
title: Windows Command-Line Persistence via TypedPaths Registry Modification
id: e444e9c2-e149-410f-bfad-83f565ab50b3
status: test
description: This rule matches process creation events where the command line contains the registry path for Explorer TypedPaths under the CurrentVersion key. Modifying TypedPaths can indicate an attempt to create or alter persistence behavior by changing how Explorer resolves typed path entries. Telemetry relies on Windows process creation logs with access to the full command line string.
references:
- https://twitter.com/dez_/status/1560101453150257154
- https://forensafe.com/blogs/typedpaths.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
tags:
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba
type: derived