Windows Registry Disk Cleanup Handler Persistence via VolumeCaches Key Creation
Detects creation of non-default Disk Cleanup Handler registry entries under VolumeCaches that may establish persistence.
- Product
- windows
- Category
- registry_add
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags creation of registry keys under the Disk Cleanup Handler locations in VolumeCaches, which can be used to register persistence mechanisms through the Windows Disk Cleanup framework. Attackers may create new handler entries so their code is invoked by legitimate maintenance workflows, blending persistence with normal OS activity. It relies on Windows registry event telemetry capturing key creation operations and the target key path containing the VolumeCaches handler base path, while excluding known default handler keys.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/diskcleanuphandler.html
- hexacorn.comhttps://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Disk Cleanup Handler Persistence via VolumeCaches Key Creation
id: 2f29c09f-d1b2-429a-92b6-a4ea076704d6
status: test
description: This rule flags creation of registry keys under the Disk Cleanup Handler locations in VolumeCaches, which can be used to register persistence mechanisms through the Windows Disk Cleanup framework. Attackers may create new handler entries so their code is invoked by legitimate maintenance workflows, blending persistence with normal OS activity. It relies on Windows registry event telemetry capturing key creation operations and the target key path containing the VolumeCaches handler base path, while excluding known default handler keys.
references:
- https://persistence-info.github.io/Data/diskcleanuphandler.html
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-02-07
tags:
- attack.persistence
logsource:
product: windows
category: registry_add
detection:
selection:
EventType: CreateKey
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\
filter_main_default_keys:
TargetObject|endswith:
- \Active Setup Temp Folders
- \BranchCache
- \Content Indexer Cleaner
- \D3D Shader Cache
- \Delivery Optimization Files
- \Device Driver Packages
- \Diagnostic Data Viewer database files
- \Downloaded Program Files
- \DownloadsFolder
- \Feedback Hub Archive log files
- \Internet Cache Files
- \Language Pack
- \Microsoft Office Temp Files
- \Offline Pages Files
- \Old ChkDsk Files
- \Previous Installations
- \Recycle Bin
- \RetailDemo Offline Content
- \Setup Log Files
- \System error memory dump files
- \System error minidump files
- \Temporary Files
- \Temporary Setup Files
- \Temporary Sync Files
- \Thumbnail Cache
- \Update Cleanup
- \Upgrade Discarded Files
- \User file versions
- \Windows Defender
- \Windows Error Reporting Files
- \Windows ESD installation files
- \Windows Upgrade Log Files
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate new entry added by windows
level: medium
license: DRL-1.1
related:
- id: d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a
type: derived