Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes

title: "Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes"
id: 3301f75a-89e9-49d7-9b20-32327960b8af
status: test
description: This rule flags changes to the Windows registry path under Explorer\TypedPaths\ within the user or admin registry hive, when the modifying process is not explorer.exe or SysWOW64\explorer.exe. Altering TypedPaths can help an attacker influence how Explorer resolves or displays typed path history, which may support persistence or related user-environment manipulation. It relies on telemetry that captures registry_set events, including the TargetObject path and the process Image that performed the modification.
references:
  - https://twitter.com/dez_/status/1560101453150257154
  - https://forensafe.com/blogs/typedpaths.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_typed_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\
  filter:
    Image:
      - C:\Windows\explorer.exe
      - C:\Windows\SysWOW64\explorer.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 086ae989-9ca6-4fe7-895a-759c5544f247
    type: derived