Windows Registry Run Key Set to Executable in Suspicious Folder
Flags new Windows Run key values pointing to executables in suspicious folders, excluding known update/Spotify patterns.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-08-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies newly set Windows Registry Run key entries that reference executables located in paths commonly associated with staging, user-controlled locations, or unusual system usage. Attackers often use Run keys for persistence by placing payloads in atypical directories and then pointing the Run entry to those files. Detection relies on registry_set telemetry capturing TargetObject and Details, including the referenced file path patterns, while excluding specific known update and Spotify autostart entries.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- github.comhttps://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-run-key-set-to-executable-in-suspicious-folder-02ee49e2
title: Windows Registry Run Key Set to Executable in Suspicious Folder
id: b4257f5c-61fd-45d6-964b-39bebef67cd0
status: experimental
description: This rule identifies newly set Windows Registry Run key entries that reference executables located in paths commonly associated with staging, user-controlled locations, or unusual system usage. Attackers often use Run keys for persistence by placing payloads in atypical directories and then pointing the Run entry to those files. Detection relies on registry_set telemetry capturing TargetObject and Details, including the referenced file path patterns, while excluding specific known update and Spotify autostart entries.
references:
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml
author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2018-08-25
modified: 2025-10-06
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection_target:
TargetObject|contains:
- \Software\Microsoft\Windows\CurrentVersion\Run
- \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
- \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
selection_suspicious_paths_1:
Details|contains:
- :\Perflogs
- :\ProgramData'
- :\Windows\Temp
- :\Temp
- \AppData\Local\Temp
- \AppData\Roaming
- :\$Recycle.bin
- :\Users\Default
- :\Users\public
- "%temp%"
- "%tmp%"
- "%Public%"
- "%AppData%"
selection_suspicious_paths_user_1:
Details|contains: :\Users\
selection_suspicious_paths_user_2:
Details|contains:
- \Favorites
- \Favourites
- \Contacts
- \Music
- \Pictures
- \Documents
- \Photos
filter_main_windows_update:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\
Image|startswith: C:\Windows\SoftwareDistribution\Download\
Details|contains|all:
- "rundll32.exe "
- C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32
Details|contains:
- \AppData\Local\Temp\
- C:\Windows\Temp\
filter_optional_spotify:
Image|endswith:
- C:\Program Files\Spotify\Spotify.exe
- C:\Program Files (x86)\Spotify\Spotify.exe
- \AppData\Roaming\Spotify\Spotify.exe
TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify
Details|endswith: Spotify.exe --autostart --minimized
condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Software using weird folders for updates
level: high
license: DRL-1.1
related:
- id: 02ee49e2-e294-4d0f-9278-f5b3212fc588
type: derived