huntrule

Windows Registry Run Key Set to Executable in Suspicious Folder

Flags new Windows Run key values pointing to executables in suspicious folders, excluding known update/Spotify patterns.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-08-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies newly set Windows Registry Run key entries that reference executables located in paths commonly associated with staging, user-controlled locations, or unusual system usage. Attackers often use Run keys for persistence by placing payloads in atypical directories and then pointing the Run entry to those files. Detection relies on registry_set telemetry capturing TargetObject and Details, including the referenced file path patterns, while excluding specific known update and Spotify autostart entries.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Interlock RAT Persistence via HKCU Run Key Registration to AppData Payload (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)
Suspicious NetSupport client32 Persistence via Run Key from ProgramData
Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)
Suspicious HTA File Dropped into Startup Folder
Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)
Windows Registry Run Key Set to Executable in Suspicious Folder
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.