Windows Registry Persistence via Disk Cleanup Handler Autorun Keys
Flags registry changes under Windows Disk Cleanup Handler VolumeCaches that set Autorun and command-like handler values.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule identifies modifications to Disk Cleanup Handler registry entries used for autorun-style persistence by matching paths under the VolumeCaches registry area, specifically values related to Autorun along with handler-specific strings. Attackers can abuse these extensibility points to execute commands without relying on traditional startup locations. The detection relies on registry set telemetry capturing the TargetObject path and associated value Details to spot suspicious command-like payloads such as cmd, PowerShell, rundll32, mshta, cscript, wscript, wsl, or startup-oriented directories.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/diskcleanuphandler.html
- hexacorn.comhttps://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Persistence via Disk Cleanup Handler Autorun Keys
id: ae7b0c69-37e7-45fe-b5aa-e4771dbd01bd
status: test
description: This rule identifies modifications to Disk Cleanup Handler registry entries used for autorun-style persistence by matching paths under the VolumeCaches registry area, specifically values related to Autorun along with handler-specific strings. Attackers can abuse these extensibility points to execute commands without relying on traditional startup locations. The detection relies on registry set telemetry capturing the TargetObject path and associated value Details to spot suspicious command-like payloads such as cmd, PowerShell, rundll32, mshta, cscript, wscript, wsl, or startup-oriented directories.
references:
- https://persistence-info.github.io/Data/diskcleanuphandler.html
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
root:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\
selection_autorun:
TargetObject|contains: \Autorun
Details: DWORD (0x00000001)
selection_pre_after:
TargetObject|contains:
- \CleanupString
- \PreCleanupString
Details|contains:
- cmd
- powershell
- rundll32
- mshta
- cscript
- wscript
- wsl
- \Users\Public\
- \Windows\TEMP\
- \Microsoft\Windows\Start Menu\Programs\Startup\
condition: root and 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: d4e2745c-f0c6-4bde-a3ab-b553b3f693cc
type: derived