Windows Registry Persistence: Uncommon .wav OpenWithProgIds Value Creation
Flags registry value writes under .wav OpenWithProgIds with unusual naming that may indicate persistence behavior.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-10
- Updated
- 2026-07-31
What it detects
This rule flags the creation of a registry value under the OpenWithProgIds key for the .wav file extension with an uncommon value name pattern. Attackers may use this location to influence how Windows associates or launches media-related files for persistence or execution. Telemetry relies on Windows registry set events that record the TargetObject path and the value name suffix/pattern.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-persistence-uncommon-wav-openwithprogids-value-creation-7e163e96
title: "Windows Registry Persistence: Uncommon .wav OpenWithProgIds Value Creation"
id: 3b2bead3-a5d2-429e-b451-00621ad0f629
status: test
description: This rule flags the creation of a registry value under the OpenWithProgIds key for the .wav file extension with an uncommon value name pattern. Attackers may use this location to influence how Windows associates or launches media-related files for persistence or execution. Telemetry relies on Windows registry set events that record the TargetObject path and the value name suffix/pattern.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/registry_set_malware_snake_encrypted_key.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
modified: 2023-08-17
tags:
- attack.persistence
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Classes\.wav\OpenWithProgIds\
filter_main_wav:
- TargetObject|endswith: .AssocFile.WAV
- TargetObject|contains: .wav.
condition: selection and not 1 of filter_main_*
falsepositives:
- Some additional tuning might be required to tune out legitimate processes that write to this key by default
level: medium
license: DRL-1.1
related:
- id: 7e163e96-b9a5-45d6-b2cd-d7d87b13c60b
type: derived