huntrule

Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
CD_R0M_ (SigmaHQ), DRL 1.1
Published
2022-06-11
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows registry entries where a custom file open handler is configured and the handler command invokes PowerShell with the -command argument. Attackers can use shell open command registrations to persist or execute scripts when files are opened, blending execution into normal user actions. The detection relies on registry set telemetry, matching the TargetObject path for shell open command values and the command contents for PowerShell invocation.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows SFTP.exe Indirect Command Execution via ProxyCommand
WSL Process Execution of Kali Linux on Windows
Windows vshadow.exe Proxy Execution via -exec Script/Command
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows Bash.exe Launched Without Script Execution Arguments
Windows Registry Custom File Open Handler Executes PowerShell
Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.