Windows Registry App Paths Default Property Change Using Suspicious Values
Alerts on Windows App Paths registry edits to (Default)/Path with suspicious binaries, scripts, or temp/public locations.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-10
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry changes where the target path is under \Software\Microsoft\Windows\CurrentVersion\App Paths and the modified value name ends with (Default) or Path. It further narrows matches to edits where the Details field contains suspicious path fragments (for example, public user locations and temp directories) or script/loader-related strings such as iex, Invoke-, rundll32, regsvr32, mshta, cscript, wscript, .bat, .hta, .dll, and .ps1. Attackers may use App Paths to influence how applications resolve executable paths and potentially establish persistence-like behavior. Telemetry relies on registry set events capturing TargetObject and the associated Details for the updated value.
Reporting behind it
- hexacorn.comhttps://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/shell/app-registration
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry App Paths Default Property Change Using Suspicious Values
id: 420b2497-d0c7-405c-9bb8-30f272d6ce0a
status: test
description: This rule flags registry changes where the target path is under \Software\Microsoft\Windows\CurrentVersion\App Paths and the modified value name ends with (Default) or Path. It further narrows matches to edits where the Details field contains suspicious path fragments (for example, public user locations and temp directories) or script/loader-related strings such as iex, Invoke-, rundll32, regsvr32, mshta, cscript, wscript, .bat, .hta, .dll, and .ps1. Attackers may use App Paths to influence how applications resolve executable paths and potentially establish persistence-like behavior. Telemetry relies on registry set events capturing TargetObject and the associated Details for the updated value.
references:
- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
- https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-10
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.012
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
TargetObject|endswith:
- (Default)
- Path
Details|contains:
- \Users\Public
- \AppData\Local\Temp\
- \Windows\Temp\
- \Desktop\
- \Downloads\
- "%temp%"
- "%tmp%"
- iex
- Invoke-
- rundll32
- regsvr32
- mshta
- cscript
- wscript
- .bat
- .hta
- .dll
- .ps1
condition: selection
falsepositives:
- Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)
level: high
license: DRL-1.1
related:
- id: 707e097c-e20f-4f67-8807-1f72ff4500d6
type: derived