Windows Registry Run Key Set to Executable in Suspicious Folder

title: Windows Registry Run Key Set to Executable in Suspicious Folder
id: b4257f5c-61fd-45d6-964b-39bebef67cd0
status: experimental
description: This rule identifies newly set Windows Registry Run key entries that reference executables located in paths commonly associated with staging, user-controlled locations, or unusual system usage. Attackers often use Run keys for persistence by placing payloads in atypical directories and then pointing the Run entry to those files. Detection relies on registry_set telemetry capturing TargetObject and Details, including the referenced file path patterns, while excluding specific known update and Spotify autostart entries.
references:
  - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml
author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2018-08-25
modified: 2025-10-06
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_target:
    TargetObject|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Run
      - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
      - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  selection_suspicious_paths_1:
    Details|contains:
      - :\Perflogs
      - :\ProgramData'
      - :\Windows\Temp
      - :\Temp
      - \AppData\Local\Temp
      - \AppData\Roaming
      - :\$Recycle.bin
      - :\Users\Default
      - :\Users\public
      - "%temp%"
      - "%tmp%"
      - "%Public%"
      - "%AppData%"
  selection_suspicious_paths_user_1:
    Details|contains: :\Users\
  selection_suspicious_paths_user_2:
    Details|contains:
      - \Favorites
      - \Favourites
      - \Contacts
      - \Music
      - \Pictures
      - \Documents
      - \Photos
  filter_main_windows_update:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\
    Image|startswith: C:\Windows\SoftwareDistribution\Download\
    Details|contains|all:
      - "rundll32.exe "
      - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32
    Details|contains:
      - \AppData\Local\Temp\
      - C:\Windows\Temp\
  filter_optional_spotify:
    Image|endswith:
      - C:\Program Files\Spotify\Spotify.exe
      - C:\Program Files (x86)\Spotify\Spotify.exe
      - \AppData\Roaming\Spotify\Spotify.exe
    TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify
    Details|endswith: Spotify.exe --autostart --minimized
  condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Software using weird folders for updates
level: high
license: DRL-1.1
related:
  - id: 02ee49e2-e294-4d0f-9278-f5b3212fc588
    type: derived