Windows Registry: Modify User Shell Folders Startup Values for Persistence
Alerts on Windows Registry changes to User Shell Folders startup-related values that may be used to establish persistence.
- Product
- windows
- Category
- registry_set
- Author
- frack113, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags updates to the User Shell Folders registry paths under Windows Explorer, specifically targeting values that end with Common Startup or Startup. Such changes can redirect startup-associated locations to attacker-controlled executables or scripts, enabling persistence at user logon or system startup. It relies on Windows registry set telemetry matching the targeted registry key paths and excluding certain known legitimate value details recorded in the rule filters.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
- welivesecurity.comhttps://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Modify User Shell Folders Startup Values for Persistence"
id: 62d14925-e739-48b5-8681-fdcd03eae0b6
related:
- id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
type: similar
- id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
type: derived
status: test
description: This rule flags updates to the User Shell Folders registry paths under Windows Explorer, specifically targeting values that end with Common Startup or Startup. Such changes can redirect startup-associated locations to attacker-controlled executables or scripts, enabling persistence at user logon or system startup. It relies on Windows registry set telemetry matching the targeted registry key paths and excluding certain known legitimate value details recorded in the rule filters.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-10-01
modified: 2026-01-05
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.001
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains:
- SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
TargetObject|endswith:
- \Common Startup
- \Startup
filter_main_details_null:
Details: null
filter_main_programdata_startup:
Details|contains:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
- "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
filter_main_userprofile_startup_1:
Details|contains:
- "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
- "%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
filter_main_userprofile_startup_2:
Details|contains|all:
- C:\Users\
- \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml
simulation:
- type: atomic-red-team
name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
technique: T1547.001
atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
license: DRL-1.1