Windows Registry Modification via PowerShell Crypto Classes in Shell Open Command

Flags registry set of \Shell\Open\Command where PowerShell references System.Security.Cryptography crypto classes.

FreeUnreviewedSigmamediumv1

windows-registry-modification-via-powershell-crypto-classes-in-shell-open-comman-1c2a3268

title: Windows Registry Modification via PowerShell Crypto Classes in Shell Open Command
id: 3b8ec551-2e77-40b1-b4e7-29e61ec483ce
status: test
description: This rule identifies registry_set activity targeting the \Shell\Open\Command value when the Details field indicates PowerShell or pwsh. It further matches when the same value references the System.Security.Cryptography namespace and specific cryptographic class names. Such behavior matters because using crypto classes in the command context can support payload decryption or obfuscation to evade defenses. The detection relies on Windows registry set telemetry with Details and TargetObject contents.
references:
  - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
  - https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-12-01
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1059.001
  - attack.t1027.010
  - attack.t1547.001
  - detection.threat-hunting
logsource:
  product: windows
  category: registry_set
detection:
  selection_key:
    TargetObject|contains: \Shell\Open\Command
  selection_value_img:
    Details|contains:
      - powershell
      - pwsh
  selection_value_namespace:
    Details|contains: System.Security.Cryptography.
  selection_value_classes:
    Details|contains:
      - .AesCryptoServiceProvider
      - .DESCryptoServiceProvider
      - .DSACryptoServiceProvider
      - .RC2CryptoServiceProvider
      - .Rijndael
      - .RSACryptoServiceProvider
      - .TripleDESCryptoServiceProvider
  condition: all of selection_*
falsepositives:
  - Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders.
level: medium
license: DRL-1.1
related:
  - id: 1c2a3268-3881-414a-80af-a5b313b14c0e
    type: derived

What it detects

This rule identifies registry_set activity targeting the \Shell\Open\Command value when the Details field indicates PowerShell or pwsh. It further matches when the same value references the System.Security.Cryptography namespace and specific cryptographic class names. Such behavior matters because using crypto classes in the command context can support payload decryption or obfuscation to evade defenses. The detection relies on Windows registry set telemetry with Details and TargetObject contents.

Known false positives

Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.