huntrule

Windows Registry Persistence via Disk Cleanup Handler Autorun Keys

Flags registry changes under Windows Disk Cleanup Handler VolumeCaches that set Autorun and command-like handler values.

FreeUnreviewedSigmamediumv1
title: Windows Registry Persistence via Disk Cleanup Handler Autorun Keys
id: ae7b0c69-37e7-45fe-b5aa-e4771dbd01bd
status: test
description: This rule identifies modifications to Disk Cleanup Handler registry entries used for autorun-style persistence by matching paths under the VolumeCaches registry area, specifically values related to Autorun along with handler-specific strings. Attackers can abuse these extensibility points to execute commands without relying on traditional startup locations. The detection relies on registry set telemetry capturing the TargetObject path and associated value Details to spot suspicious command-like payloads such as cmd, PowerShell, rundll32, mshta, cscript, wscript, wsl, or startup-oriented directories.
references:
  - https://persistence-info.github.io/Data/diskcleanuphandler.html
  - https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  root:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\
  selection_autorun:
    TargetObject|contains: \Autorun
    Details: DWORD (0x00000001)
  selection_pre_after:
    TargetObject|contains:
      - \CleanupString
      - \PreCleanupString
    Details|contains:
      - cmd
      - powershell
      - rundll32
      - mshta
      - cscript
      - wscript
      - wsl
      - \Users\Public\
      - \Windows\TEMP\
      - \Microsoft\Windows\Start Menu\Programs\Startup\
  condition: root and 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d4e2745c-f0c6-4bde-a3ab-b553b3f693cc
    type: derived

What it detects

This rule identifies modifications to Disk Cleanup Handler registry entries used for autorun-style persistence by matching paths under the VolumeCaches registry area, specifically values related to Autorun along with handler-specific strings. Attackers can abuse these extensibility points to execute commands without relying on traditional startup locations. The detection relies on registry set telemetry capturing the TargetObject path and associated value Details to spot suspicious command-like payloads such as cmd, PowerShell, rundll32, mshta, cscript, wscript, wsl, or startup-oriented directories.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.