huntrule

Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key

Flags registry value deletions on a Narrator Feedback-Hub AppX DelegateExecute path used for persistence.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_event
Author
Dmitriy Lifanov, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects registry value deletion events that target a specific AppX key path associated with Windows 10 Narrator’s Feedback-Hub. It matches attempts to manipulate DelegateExecute-related values, which can support persistence by redirecting how commands are invoked. Telemetry required is registry event logs showing EventType=DeleteValue and the TargetObject ending in the DelegateExecute or (Default) paths.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Malicious Run Key Persistence Referencing DLL in User Documents
PlugX Persistence via Run Key Named AAM Updatevlm
Suspicious Autorun Registry Persistence via sausageLoop Run Key
Malicious BabyLockerKZ Run Key Persistence
Suspicious Run Key Persistence Pointing To User-Writable Path
Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)
Persistence Run Key Pointing to svchost.exe in AppData Roaming
URL Shortcut File Created in Startup Folder for Persistence
Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos
Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.