huntrule

Windows Registry: Modify User Shell Folders Startup Values for Persistence

Alerts on Windows Registry changes to User Shell Folders startup-related values that may be used to establish persistence.

FreeUnreviewedSigmahighv1
title: "Windows Registry: Modify User Shell Folders Startup Values for Persistence"
id: 62d14925-e739-48b5-8681-fdcd03eae0b6
related:
  - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
    type: similar
  - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
    type: derived
status: test
description: This rule flags updates to the User Shell Folders registry paths under Windows Explorer, specifically targeting values that end with Common Startup or Startup. Such changes can redirect startup-associated locations to attacker-controlled executables or scripts, enabling persistence at user logon or system startup. It relies on Windows registry set telemetry matching the targeted registry key paths and excluding certain known legitimate value details recorded in the rule filters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-10-01
modified: 2026-01-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.001
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
      - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    TargetObject|endswith:
      - \Common Startup
      - \Startup
  filter_main_details_null:
    Details: null
  filter_main_programdata_startup:
    Details|contains:
      - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
      - "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
  filter_main_userprofile_startup_1:
    Details|contains:
      - "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
      - "%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
  filter_main_userprofile_startup_2:
    Details|contains|all:
      - C:\Users\
      - \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml
simulation:
  - type: atomic-red-team
    name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
    technique: T1547.001
    atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
license: DRL-1.1

What it detects

This rule flags updates to the User Shell Folders registry paths under Windows Explorer, specifically targeting values that end with Common Startup or Startup. Such changes can redirect startup-associated locations to attacker-controlled executables or scripts, enabling persistence at user logon or system startup. It relies on Windows registry set telemetry matching the targeted registry key paths and excluding certain known legitimate value details recorded in the rule filters.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.