Windows Registry Shell Context Menu Command Tampering via shell\command Key Changes

Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.

FreeUnreviewedSigmalowv1

windows-registry-shell-context-menu-command-tampering-via-shell-command-key-chan-868df2d1

title: Windows Registry Shell Context Menu Command Tampering via shell\command Key Changes
id: 45571af7-7812-41e3-b232-1ae0dea59117
status: test
description: This rule identifies registry writes that modify Windows shell context menu command registrations under the Classes\shell\command paths. Attackers can use context menu tampering to persist execution and run unwanted commands when a user interacts with files or folders. The detection relies on registry_set telemetry that captures changes to TargetObject values containing the relevant shell and command subkeys.
references:
  - https://mrd0x.com/sentinelone-persistence-via-menu-context/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_shell_context_menu_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-06
tags:
  - attack.persistence
  - detection.threat-hunting
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \Software\Classes\
      - \shell\
      - \command\
  condition: selection
falsepositives:
  - Likely from new software installation suggesting to add context menu items. Such as "PowerShell", "Everything", "Git", etc.
level: low
license: DRL-1.1
related:
  - id: 868df2d1-0939-4562-83a7-27408c4a1ada
    type: derived

What it detects

This rule identifies registry writes that modify Windows shell context menu command registrations under the Classes\shell\command paths. Attackers can use context menu tampering to persist execution and run unwanted commands when a user interacts with files or folders. The detection relies on registry_set telemetry that captures changes to TargetObject values containing the relevant shell and command subkeys.

Known false positives

Likely from new software installation suggesting to add context menu items. Such as "PowerShell", "Everything", "Git", etc.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.