huntrule

Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths

Alerts on writes to the Explorer Run policy registry key with details pointing to suspicious filesystem paths.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Florian Roth (Nextron Systems), oscd.community (SigmaHQ), DRL 1.1
Published
2018-07-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry entries that write to the Windows Explorer Run policies key and whose details reference common suspicious or attacker-controlled locations. Such persistence can cause code to execute in Explorer context, enabling repeated execution after reboot. It relies on Windows registry set telemetry capturing the TargetObject path and the Details content for matches to specific suspicious folder patterns.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Interlock RAT Persistence via HKCU Run Key Registration to AppData Payload (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)
Suspicious NetSupport client32 Persistence via Run Key from ProgramData
Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)
Suspicious HTA File Dropped into Startup Folder
Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)
Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.