Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

FreeUnreviewedSigmahighv1

windows-registry-custom-file-open-handler-executes-powershell-7530b96f

title: Windows Registry Custom File Open Handler Executes PowerShell
id: c0e1537b-21b5-418f-baff-ee71368b060e
status: test
description: This rule flags Windows registry entries where a custom file open handler is configured and the handler command invokes PowerShell with the -command argument. Attackers can use shell open command registrations to persist or execute scripts when files are opened, blending execution into normal user actions. The detection relies on registry set telemetry, matching the TargetObject path for shell open command values and the command contents for PowerShell invocation.
references:
  - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml
author: CD_R0M_, Huntrule Team
date: 2022-06-11
modified: 2023-08-17
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: shell\open\command\
    Details|contains|all:
      - powershell
      - -command
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc
    type: derived

What it detects

This rule flags Windows registry entries where a custom file open handler is configured and the handler command invokes PowerShell with the -command argument. Attackers can use shell open command registrations to persist or execute scripts when files are opened, blending execution into normal user actions. The detection relies on registry set telemetry, matching the TargetObject path for shell open command values and the command contents for PowerShell invocation.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.