Windows Registry Persistence via HtmlHelp Author Location Modification
Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags registry changes to the HtmlHelp Author Location value under Microsoft HtmlHelp-related keys, including the WOW6432Node variant. Attackers can abuse these settings to influence how trusted components locate supporting content, enabling persistence. Telemetry relies on Windows registry set events capturing the TargetObject path containing the specified Location values.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-persistence-via-htmlhelp-author-location-modification-976dd1f2
title: Windows Registry Persistence via HtmlHelp Author Location Modification
id: 7d77e302-32a4-436e-b63b-d27a252f9a09
status: test
description: This rule flags registry changes to the HtmlHelp Author Location value under Microsoft HtmlHelp-related keys, including the WOW6432Node variant. Attackers can abuse these settings to influence how trusted components locate supporting content, enabling persistence. Telemetry relies on Windows registry set events capturing the TargetObject path containing the specified Location values.
references:
- https://persistence-info.github.io/Data/htmlhelpauthor.html
- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_chm.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \Software\Microsoft\HtmlHelp Author\Location
- \Software\WOW6432Node\Microsoft\HtmlHelp Author\Location
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 976dd1f2-a484-45ec-aa1d-0e87e882262b
type: derived