Windows Registry Run Key Persistence Using Small Sieve Typo Value Strings
Flags registry Run-key writes on Windows with Small Sieve-specific typo and executable detail strings in value data.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-19
- Updated
- 2026-07-31
What it detects
This rule flags Windows registry modifications that create or update Run key entries containing specific, intentionally misspelled value components and a recognizable “.exe Platypus” details string. Such persistence enables malware to launch on user login, and the unusual typo acts as an identifiable marker for this behavior. Telemetry relies on registry set events capturing the TargetObject and associated TargetObject/Details contents.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-run-key-persistence-with-small-sieve-typos-in-value-data-65c6e3c1
title: Windows Registry Run Key Persistence Using Small Sieve Typo Value Strings
id: 370823d0-d40f-42e9-80ab-e8441d111df4
status: test
description: This rule flags Windows registry modifications that create or update Run key entries containing specific, intentionally misspelled value components and a recognizable “.exe Platypus” details string. Such persistence enables malware to launch on user login, and the unusual typo acts as an identifiable marker for this behavior. Telemetry relies on registry set events capturing the TargetObject and associated TargetObject/Details contents.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/registry_set_malware_small_sieve_evasion_typo.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
modified: 2023-08-17
tags:
- attack.persistence
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection_path:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\Run\
selection_value:
- TargetObject|contains: Microsift
- Details|contains: .exe Platypus
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 65c6e3c1-fb28-4c03-a51e-84919d8185f1
type: derived