Windows Registry Persistence via MyComputer \"Default\" Value Modification

Detects changes to Explorer\MyComputer (Default) registry value that can redirect a launched binary for persistence.

FreeUnreviewedSigmahighv1

windows-registry-persistence-via-mycomputer-default-value-modification-8fbe98a8

title: Windows Registry Persistence via MyComputer \"Default\" Value Modification
id: 332ccc12-6c63-468f-b3d5-5c788dd46cf0
status: test
description: This rule flags registry changes where the TargetObject path contains the Explorer\MyComputer key and the modified value name ends with (Default). Attackers can use this to redirect the associated MyComputer action to load a custom binary, creating persistence. It relies on Windows registry set telemetry that includes the modified TargetObject path and value name.
references:
  - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_mycomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-09
modified: 2024-01-11
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer
    TargetObject|endswith: (Default)
  condition: selection
falsepositives:
  - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high
license: DRL-1.1
related:
  - id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
    type: derived

What it detects

This rule flags registry changes where the TargetObject path contains the Explorer\MyComputer key and the modified value name ends with (Default). Attackers can use this to redirect the associated MyComputer action to load a custom binary, creating persistence. It relies on Windows registry set telemetry that includes the modified TargetObject path and value name.

Known false positives

Unlikely but if you experience FPs add specific processes and locations you would like to monitor for

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.