Windows Registry Persistence via MyComputer \"Default\" Value Modification
Detects changes to Explorer\MyComputer (Default) registry value that can redirect a launched binary for persistence.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-09
- Updated
- 2026-07-30
What it detects
This rule flags registry changes where the TargetObject path contains the Explorer\MyComputer key and the modified value name ends with (Default). Attackers can use this to redirect the associated MyComputer action to load a custom binary, creating persistence. It relies on Windows registry set telemetry that includes the modified TargetObject path and value name.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-persistence-via-mycomputer-default-value-modification-8fbe98a8
title: Windows Registry Persistence via MyComputer \"Default\" Value Modification
id: 332ccc12-6c63-468f-b3d5-5c788dd46cf0
status: test
description: This rule flags registry changes where the TargetObject path contains the Explorer\MyComputer key and the modified value name ends with (Default). Attackers can use this to redirect the associated MyComputer action to load a custom binary, creating persistence. It relies on Windows registry set telemetry that includes the modified TargetObject path and value name.
references:
- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_mycomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-09
modified: 2024-01-11
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer
TargetObject|endswith: (Default)
condition: selection
falsepositives:
- Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high
license: DRL-1.1
related:
- id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
type: derived