Windows Registry: Suspicious Space-Padded TypedPaths Details String

title: "Windows Registry: Suspicious Space-Padded TypedPaths Details String"
id: fe536432-50ed-40bb-9e41-1a5c14e50f1c
related:
  - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
    type: similar
  - id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
    type: derived
status: experimental
description: This rule flags registry set activity targeting the Explorer TypedPaths url1 entry when the Details field contains a fragment marker and a high density of space-like Unicode characters. Attackers may use visually subtle spacing to obscure malicious content or execution paths from casual review. The detection relies on Windows registry set telemetry capturing the TargetObject and Details values written under TypedPaths.
references:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-04
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.004
  - attack.t1027.010
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1
    Details|contains: "#"
  selection_space_variation:
    Details|contains:
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      - "            "
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1