huntrule

Windows Registry Persistence via HtmlHelp Author Location Modification

Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-21
Updated
2026-07-30
AnalysisDetection
title: Windows Registry Persistence via HtmlHelp Author Location Modification
id: 7d77e302-32a4-436e-b63b-d27a252f9a09
status: test
description: This rule flags registry changes to the HtmlHelp Author Location value under Microsoft HtmlHelp-related keys, including the WOW6432Node variant. Attackers can abuse these settings to influence how trusted components locate supporting content, enabling persistence. Telemetry relies on Windows registry set events capturing the TargetObject path containing the specified Location values.
references:
  - https://persistence-info.github.io/Data/htmlhelpauthor.html
  - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_chm.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Software\Microsoft\HtmlHelp Author\Location
      - \Software\WOW6432Node\Microsoft\HtmlHelp Author\Location
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 976dd1f2-a484-45ec-aa1d-0e87e882262b
    type: derived