Windows Registry Custom File Open Handler Executes PowerShell

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry entries where a custom file open handler is configured and the handler command invokes PowerShell with the -command argument. Attackers can use shell open command registrations to persist or execute scripts when files are opened, blending execution into normal user actions. The detection relies on registry set telemetry, matching the TargetObject path for shell open command values and the command contents for PowerShell invocation.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows Registry Custom File Open Handler Executes PowerShell

Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-custom-file-open-handler-executes-powershell-7530b96f

title: Windows Registry Custom File Open Handler Executes PowerShell
id: c0e1537b-21b5-418f-baff-ee71368b060e
status: test
description: This rule flags Windows registry entries where a custom file open handler is configured and the handler command invokes PowerShell with the -command argument. Attackers can use shell open command registrations to persist or execute scripts when files are opened, blending execution into normal user actions. The detection relies on registry set telemetry, matching the TargetObject path for shell open command values and the command contents for PowerShell invocation.
references:
  - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml
author: CD_R0M_, Huntrule Team
date: 2022-06-11
modified: 2023-08-17
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: shell\open\command\
    Details|contains|all:
      - powershell
      - -command
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL