huntrule

Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths

Alerts on writes to the Explorer Run policy registry key with details pointing to suspicious filesystem paths.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Florian Roth (Nextron Systems), oscd.community (SigmaHQ), DRL 1.1
Published
2018-07-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry entries that write to the Windows Explorer Run policies key and whose details reference common suspicious or attacker-controlled locations. Such persistence can cause code to execute in Explorer context, enabling repeated execution after reboot. It relies on Windows registry set telemetry capturing the TargetObject path and the Details content for matches to specific suspicious folder patterns.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Autorun Registry Persistence via sausageLoop Run Key
Malicious BabyLockerKZ Run Key Persistence
Suspicious Run Key Persistence Pointing To User-Writable Path
Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)
Persistence Run Key Pointing to svchost.exe in AppData Roaming
URL Shortcut File Created in Startup Folder for Persistence
Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos
Suspicious Run Key Persistence Pointing to AppData Local Copy
Malicious WezRat Persistence via Chrome Updater Run Key
Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.