Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language
Alerts on Windows registry changes to ContentIndex Natural Language DLLPathOverride values tied to SearchIndexer.exe persistence.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags registry modifications under the ContentIndex “Natural Language” area where values related to DLLPathOverride (and associated class entries) are written. Attackers can use these settings to influence how SearchIndexer.exe loads components, enabling persistence without dropping a new executable payload. The detection relies on Windows registry set telemetry that records the modified TargetObject paths and value name patterns containing the specified DLL/class override entries.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/naturallanguage6.html
- hexacorn.comhttps://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language"
id: d2cda429-3ba4-4be1-9a64-5514fc7bd378
status: test
description: This rule flags registry modifications under the ContentIndex “Natural Language” area where values related to DLLPathOverride (and associated class entries) are written. Attackers can use these settings to influence how SearchIndexer.exe loads components, enabling persistence without dropping a new executable payload. The detection relies on Windows registry set telemetry that records the modified TargetObject paths and value name patterns containing the specified DLL/class override entries.
references:
- https://persistence-info.github.io/Data/naturallanguage6.html
- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection_root:
TargetObject|contains: \SYSTEM\CurrentControlSet\Control\ContentIndex\Language\
selection_values:
TargetObject|contains:
- \StemmerDLLPathOverride
- \WBDLLPathOverride
- \StemmerClass
- \WBreakerClass
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8
type: derived