Windows Registry Persistence via HtmlHelp Author Location Modification

title: Windows Registry Persistence via HtmlHelp Author Location Modification
id: 7d77e302-32a4-436e-b63b-d27a252f9a09
status: test
description: This rule flags registry changes to the HtmlHelp Author Location value under Microsoft HtmlHelp-related keys, including the WOW6432Node variant. Attackers can abuse these settings to influence how trusted components locate supporting content, enabling persistence. Telemetry relies on Windows registry set events capturing the TargetObject path containing the specified Location values.
references:
  - https://persistence-info.github.io/Data/htmlhelpauthor.html
  - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_chm.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Software\Microsoft\HtmlHelp Author\Location
      - \Software\WOW6432Node\Microsoft\HtmlHelp Author\Location
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 976dd1f2-a484-45ec-aa1d-0e87e882262b
    type: derived