huntrule

Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key

Flags registry value deletions on a Narrator Feedback-Hub AppX DelegateExecute path used for persistence.

FreeUnreviewedSigmahighv1
title: "Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key"
id: 5ef5f148-23e1-4d27-984a-a6ed5a1b21d7
status: test
description: This rule detects registry value deletion events that target a specific AppX key path associated with Windows 10 Narrator’s Feedback-Hub. It matches attempts to manipulate DelegateExecute-related values, which can support persistence by redirecting how commands are invoked. Telemetry required is registry event logs showing EventType=DeleteValue and the TargetObject ending in the DelegateExecute or (Default) paths.
references:
  - https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml
author: Dmitriy Lifanov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2022-03-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_event
  product: windows
detection:
  selection1:
    EventType: DeleteValue
    TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute
  selection2:
    TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default)
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f663a6d9-9d1b-49b8-b2b1-0637914d199a
    type: derived

What it detects

This rule detects registry value deletion events that target a specific AppX key path associated with Windows 10 Narrator’s Feedback-Hub. It matches attempts to manipulate DelegateExecute-related values, which can support persistence by redirecting how commands are invoked. Telemetry required is registry event logs showing EventType=DeleteValue and the TargetObject ending in the DelegateExecute or (Default) paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.