Windows Registry Persistence: Uncommon .wav OpenWithProgIds Value Creation

Flags registry value writes under .wav OpenWithProgIds with unusual naming that may indicate persistence behavior.

FreeUnreviewedSigmamediumv1

windows-registry-persistence-uncommon-wav-openwithprogids-value-creation-7e163e96

title: "Windows Registry Persistence: Uncommon .wav OpenWithProgIds Value Creation"
id: 3b2bead3-a5d2-429e-b451-00621ad0f629
status: test
description: This rule identifies when a process creates or sets a registry value under the Windows Classes key for the .wav extension at "OpenWithProgIds" with an uncommon target name pattern. Attackers can abuse this location to influence how the system associates and opens file types, supporting persistence or execution chaining. The detection relies on registry set telemetry for the TargetObject path and uses string matching on the key and value naming to flag suspicious instances.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/registry_set_malware_snake_encrypted_key.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
modified: 2023-08-17
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Classes\.wav\OpenWithProgIds\
  filter_main_wav:
    - TargetObject|endswith: .AssocFile.WAV
    - TargetObject|contains: .wav.
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Some additional tuning might be required to tune out legitimate processes that write to this key by default
level: medium
license: DRL-1.1
related:
  - id: 7e163e96-b9a5-45d6-b2cd-d7d87b13c60b
    type: derived

What it detects

This rule identifies when a process creates or sets a registry value under the Windows Classes key for the .wav extension at "OpenWithProgIds" with an uncommon target name pattern. Attackers can abuse this location to influence how the system associates and opens file types, supporting persistence or execution chaining. The detection relies on registry set telemetry for the TargetObject path and uses string matching on the key and value naming to flag suspicious instances.

Known false positives

Some additional tuning might be required to tune out legitimate processes that write to this key by default

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.