Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths

title: Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths
id: c9beba33-2010-4191-b4fb-e7e355124ed9
status: test
description: This rule flags registry entries that write to the Windows Explorer Run policies key and whose details reference common suspicious or attacker-controlled locations. Such persistence can cause code to execute in Explorer context, enabling repeated execution after reboot. It relies on Windows registry set telemetry capturing the TargetObject path and the Details content for matches to specific suspicious folder patterns.
references:
  - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml
author: Florian Roth (Nextron Systems), oscd.community, Huntrule Team
date: 2018-07-18
modified: 2023-12-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    Details|contains:
      - :\$Recycle.bin\
      - :\ProgramData\
      - :\Temp\
      - :\Users\Default\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b7916c2a-fa2f-4795-9477-32b731f70f11
    type: derived