Windows Shell Context Menu Registry Command Tampering
Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-03-06
- Updated
- 2026-07-31
What it detects
This rule identifies registry modifications under the Windows shell context menu command paths. Attackers commonly abuse context menu extensibility for persistence or to execute malicious commands when a user interacts with files or directories. It relies on telemetry that records registry set operations and matches writes to keys containing \Software\Classes\shell\command.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-shell-context-menu-command-tampering-via-shell-command-key-chan-868df2d1
title: Windows Shell Context Menu Registry Command Tampering
id: 45571af7-7812-41e3-b232-1ae0dea59117
status: test
description: This rule identifies registry modifications under the Windows shell context menu command paths. Attackers commonly abuse context menu extensibility for persistence or to execute malicious commands when a user interacts with files or directories. It relies on telemetry that records registry set operations and matches writes to keys containing \Software\Classes\shell\command.
references:
- https://mrd0x.com/sentinelone-persistence-via-menu-context/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_shell_context_menu_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-06
tags:
- attack.persistence
- detection.threat-hunting
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \Software\Classes\
- \shell\
- \command\
condition: selection
falsepositives:
- Likely from new software installation suggesting to add context menu items. Such as "PowerShell", "Everything", "Git", etc.
level: low
license: DRL-1.1
related:
- id: 868df2d1-0939-4562-83a7-27408c4a1ada
type: derived