Windows Registry Classes Autorun Key Modification for Persistence
Alerts on registry changes under Windows Classes shell extension/ASEP paths that may enable persistence.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags changes to Windows Registry Classes keys that are used as autostart extensibility points (ASEP). Attackers can leverage these registry locations to have malicious code invoked when file types are opened or shell actions are performed. It relies on registry set events capturing the modified TargetObject path and filters out specific known benign conditions based on Image and Details fields.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- gist.github.comhttps://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-classes-autorun-key-modification-for-persistence-9df5f547
title: Windows Registry Classes Autorun Key Modification for Persistence
id: 03d6863d-b320-4d62-9153-71278fb8fd27
related:
- id: 17f878b8-9968-4578-b814-c4217fc5768c
type: obsolete
- id: 9df5f547-c86a-433e-b533-f2794357e242
type: derived
status: test
description: This rule flags changes to Windows Registry Classes keys that are used as autostart extensibility points (ASEP). Attackers can leverage these registry locations to have malicious code invoked when file types are opened or shell actions are performed. It relies on registry set events capturing the modified TargetObject path and filters out specific known benign conditions based on Image and Details fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule Team
date: 2019-10-25
modified: 2025-10-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection_classes_base:
TargetObject|contains: \Software\Classes
selection_classes_target:
TargetObject|contains:
- \Folder\ShellEx\ExtShellFolderViews
- \Folder\ShellEx\DragDropHandlers
- \Folder\Shellex\ColumnHandlers
- \Filter
- \Exefile\Shell\Open\Command\(Default)
- \Directory\Shellex\DragDropHandlers
- \Directory\Shellex\CopyHookHandlers
- \CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance
- \CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance
- \CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance
- \CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance
- \Classes\AllFileSystemObjects\ShellEx\DragDropHandlers
- \.exe
- \.cmd
- \ShellEx\PropertySheetHandlers
- \ShellEx\ContextMenuHandlers
filter_main_drivers:
Image: C:\Windows\System32\drvinst.exe
filter_main_empty:
Details: (Empty)
filter_main_null:
Details: null
filter_main_svchost:
Image: C:\Windows\System32\svchost.exe
TargetObject|contains: \lnkfile\shellex\ContextMenuHandlers\
filter_optional_msoffice:
Details: "{807583E5-5146-11D5-A672-00B0D022E945}"
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
level: medium
license: DRL-1.1