huntrule

Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key

Flags registry value deletions on a Narrator Feedback-Hub AppX DelegateExecute path used for persistence.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_event
Author
Dmitriy Lifanov, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects registry value deletion events that target a specific AppX key path associated with Windows 10 Narrator’s Feedback-Hub. It matches attempts to manipulate DelegateExecute-related values, which can support persistence by redirecting how commands are invoked. Telemetry required is registry event logs showing EventType=DeleteValue and the TargetObject ending in the DelegateExecute or (Default) paths.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Interlock RAT Persistence via HKCU Run Key Registration to AppData Payload (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)
Suspicious NetSupport client32 Persistence via Run Key from ProgramData
Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)
Suspicious HTA File Dropped into Startup Folder
Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)
Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.