Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes
Flags registry set of \Shell\Open\Command where PowerShell references System.Security.Cryptography crypto classes.
- Product
- windows
- Category
- registry_set
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2023-12-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry value updates to the "\Shell\Open\Command" location where the value details reference PowerShell (powershell/pwsh) and .NET cryptography classes from System.Security.Cryptography. The behavior matters because attackers can embed cryptographic classes in PowerShell-driven command strings to support on-the-fly encryption/decryption for stealth or payload handling. It relies on registry set telemetry that includes the registry TargetObject path and the Details content where the PowerShell executable and specific cryptography class names appear.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
- squiblydoo.bloghttps://squiblydoo.blog/2023/11/07/october-2023-solarmarker/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes
id: 3b8ec551-2e77-40b1-b4e7-29e61ec483ce
status: test
description: This rule flags registry value updates to the "\Shell\Open\Command" location where the value details reference PowerShell (powershell/pwsh) and .NET cryptography classes from System.Security.Cryptography. The behavior matters because attackers can embed cryptographic classes in PowerShell-driven command strings to support on-the-fly encryption/decryption for stealth or payload handling. It relies on registry set telemetry that includes the registry TargetObject path and the Details content where the PowerShell executable and specific cryptography class names appear.
references:
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
- https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-12-01
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1059.001
- attack.t1027.010
- attack.t1547.001
- detection.threat-hunting
logsource:
product: windows
category: registry_set
detection:
selection_key:
TargetObject|contains: \Shell\Open\Command
selection_value_img:
Details|contains:
- powershell
- pwsh
selection_value_namespace:
Details|contains: System.Security.Cryptography.
selection_value_classes:
Details|contains:
- .AesCryptoServiceProvider
- .DESCryptoServiceProvider
- .DSACryptoServiceProvider
- .RC2CryptoServiceProvider
- .Rijndael
- .RSACryptoServiceProvider
- .TripleDESCryptoServiceProvider
condition: all of selection_*
falsepositives:
- Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders.
level: medium
license: DRL-1.1
related:
- id: 1c2a3268-3881-414a-80af-a5b313b14c0e
type: derived