Windows Registry App Paths Default Property Change Using Suspicious Values

Alerts on Windows App Paths registry edits to (Default)/Path with suspicious binaries, scripts, or temp/public locations.

FreeUnreviewedSigmahighv1

windows-registry-app-paths-default-property-change-using-suspicious-values-707e097c

title: Windows Registry App Paths Default Property Change Using Suspicious Values
id: 420b2497-d0c7-405c-9bb8-30f272d6ce0a
status: test
description: This rule flags registry changes where the target path is under \Software\Microsoft\Windows\CurrentVersion\App Paths and the modified value name ends with (Default) or Path. It further narrows matches to edits where the Details field contains suspicious path fragments (for example, public user locations and temp directories) or script/loader-related strings such as iex, Invoke-, rundll32, regsvr32, mshta, cscript, wscript, .bat, .hta, .dll, and .ps1. Attackers may use App Paths to influence how applications resolve executable paths and potentially establish persistence-like behavior. Telemetry relies on registry set events capturing TargetObject and the associated Details for the updated value.
references:
  - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
  - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-10
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.012
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
    TargetObject|endswith:
      - (Default)
      - Path
    Details|contains:
      - \Users\Public
      - \AppData\Local\Temp\
      - \Windows\Temp\
      - \Desktop\
      - \Downloads\
      - "%temp%"
      - "%tmp%"
      - iex
      - Invoke-
      - rundll32
      - regsvr32
      - mshta
      - cscript
      - wscript
      - .bat
      - .hta
      - .dll
      - .ps1
  condition: selection
falsepositives:
  - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)
level: high
license: DRL-1.1
related:
  - id: 707e097c-e20f-4f67-8807-1f72ff4500d6
    type: derived

What it detects

This rule flags registry changes where the target path is under \Software\Microsoft\Windows\CurrentVersion\App Paths and the modified value name ends with (Default) or Path. It further narrows matches to edits where the Details field contains suspicious path fragments (for example, public user locations and temp directories) or script/loader-related strings such as iex, Invoke-, rundll32, regsvr32, mshta, cscript, wscript, .bat, .hta, .dll, and .ps1. Attackers may use App Paths to influence how applications resolve executable paths and potentially establish persistence-like behavior. Telemetry relies on registry set events capturing TargetObject and the associated Details for the updated value.

Known false positives

Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.