Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes
Alerts on changes to Explorer TypedPaths registry entries from processes other than explorer.exe.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-22
- Updated
- 2026-07-30
What it detects
This rule flags changes to the Windows registry path under Explorer\TypedPaths\ within the user or admin registry hive, when the modifying process is not explorer.exe or SysWOW64\explorer.exe. Altering TypedPaths can help an attacker influence how Explorer resolves or displays typed path history, which may support persistence or related user-environment manipulation. It relies on telemetry that captures registry_set events, including the TargetObject path and the process Image that performed the modification.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes"
id: 3301f75a-89e9-49d7-9b20-32327960b8af
status: test
description: This rule flags changes to the Windows registry path under Explorer\TypedPaths\ within the user or admin registry hive, when the modifying process is not explorer.exe or SysWOW64\explorer.exe. Altering TypedPaths can help an attacker influence how Explorer resolves or displays typed path history, which may support persistence or related user-environment manipulation. It relies on telemetry that captures registry_set events, including the TargetObject path and the process Image that performed the modification.
references:
- https://twitter.com/dez_/status/1560101453150257154
- https://forensafe.com/blogs/typedpaths.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_typed_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\
filter:
Image:
- C:\Windows\explorer.exe
- C:\Windows\SysWOW64\explorer.exe
condition: selection and not filter
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 086ae989-9ca6-4fe7-895a-759c5544f247
type: derived