Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language

title: "Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language"
id: d2cda429-3ba4-4be1-9a64-5514fc7bd378
status: test
description: This rule flags registry modifications under the ContentIndex “Natural Language” area where values related to DLLPathOverride (and associated class entries) are written. Attackers can use these settings to influence how SearchIndexer.exe loads components, enabling persistence without dropping a new executable payload. The detection relies on Windows registry set telemetry that records the modified TargetObject paths and value name patterns containing the specified DLL/class override entries.
references:
  - https://persistence-info.github.io/Data/naturallanguage6.html
  - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection_root:
    TargetObject|contains: \SYSTEM\CurrentControlSet\Control\ContentIndex\Language\
  selection_values:
    TargetObject|contains:
      - \StemmerDLLPathOverride
      - \WBDLLPathOverride
      - \StemmerClass
      - \WBreakerClass
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8
    type: derived