Windows Registry: New IFilter Registration via PersistentHandler/CLSID Keys
Flags registry writes that register new Windows Search IFilters/persistent handlers via PersistentHandler and CLSID key patterns.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule identifies Windows attempts to register new content extraction components for Windows Search by writing registry entries under PersistentHandler and related CLSID paths. Attackers can abuse IFilters to extend indexing for attacker-controlled file types and support persistence and execution chains leveraging search-related processing. It relies on registry_set telemetry that records TargetObject writes containing the expected PersistentHandler and CLSID key patterns and matches them against a set of known default persistent handler CLSIDs to reduce noise.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/ifilters.html
- twitter.comhttps://twitter.com/0gtweet/status/1468548924600459267
- github.comhttps://github.com/gtworek/PSBits/tree/master/IFilter
- github.comhttps://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-new-ifilter-registration-via-persistenthandler-clsid-keys-b23818c7
title: "Windows Registry: New IFilter Registration via PersistentHandler/CLSID Keys"
id: 923ecd28-5935-4e2c-ae8b-86cfa9abb9e6
status: test
description: This rule identifies Windows attempts to register new content extraction components for Windows Search by writing registry entries under PersistentHandler and related CLSID paths. Attackers can abuse IFilters to extend indexing for attacker-controlled file types and support persistence and execution chains leveraging search-related processing. It relies on registry_set telemetry that records TargetObject writes containing the expected PersistentHandler and CLSID key patterns and matches them against a set of known default persistent handler CLSIDs to reduce noise.
references:
- https://persistence-info.github.io/Data/ifilters.html
- https://twitter.com/0gtweet/status/1468548924600459267
- https://github.com/gtworek/PSBits/tree/master/IFilter
- https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2024-03-26
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection_ext:
TargetObject|contains|all:
- \SOFTWARE\Classes\.
- \PersistentHandler
selection_clsid:
TargetObject|contains|all:
- \SOFTWARE\Classes\CLSID
- \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}
filter_default_targets:
TargetObject|contains:
- \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\
- \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\
- \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\
- \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\
- \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\
- \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\
- \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\
- \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\
- \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\
- \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\
- \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\
- \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\
- \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\
- \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\
- \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\
- \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\
- \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\
- \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\
- \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\
- \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\
- \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\
- \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\
- \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\
- \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\
- \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\
- \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\
- \CLSID\{eec97550-47a9-11cf-b952-00aa0051fe20}
- \CLSID\{FB10BD80-A331-4e9e-9EB7-00279903AD99}\
filter_generic_paths:
Image|startswith:
- C:\Windows\System32\
- C:\Program Files (x86)\
- C:\Program Files\
condition: 1 of selection_* and not 1 of filter_*
falsepositives:
- Legitimate registration of IFilters by the OS or software
level: medium
license: DRL-1.1
related:
- id: b23818c7-e575-4d13-8012-332075ec0a2b
type: derived