Windows Registry: Suspicious Space-Padded TypedPaths Details String

Alerts on registry writes to TypedPaths url1 where Details includes “#” plus unusual Unicode space padding.

FreeReviewedSigma · High · v1

Product: windows
Category: registry_set
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-04
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1204User Execution
Persistence
Priv Esc
Defense Evasion
- T1027.010Command Obfuscation
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags registry set activity targeting the Explorer TypedPaths url1 entry when the Details field contains a fragment marker and a high density of space-like Unicode characters. Attackers may use visually subtle spacing to obscure malicious content or execution paths from casual review. The detection relies on Windows registry set telemetry capturing the TargetObject and Details values written under TypedPaths.

Reporting behind it

Related detections9 linkedT1204 — drag to rearrange

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter

Malicious Edge Abuse for Payload Download via Console (via process_creation)

PowerShell Command-Line Obfuscation Constructs (via process_creation)

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Linux Process Execution of Python Base64 Decode One-Liners

Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Windows Registry: Suspicious Space-Padded TypedPaths Details String

Pivot detection · T1204 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-suspicious-space-padded-typedpaths-details-string-8f2a5c3d

title: "Windows Registry: Suspicious Space-Padded TypedPaths Details String"
id: fe536432-50ed-40bb-9e41-1a5c14e50f1c
related:
  - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
    type: similar
  - id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
    type: derived
status: experimental
description: This rule flags registry set activity targeting the Explorer TypedPaths url1 entry when the Details field contains a fragment marker and a high density of space-like Unicode characters. Attackers may use visually subtle spacing to obscure malicious content or execution paths from casual review. The detection relies on Windows registry set telemetry capturing the TargetObject and Details values written under TypedPaths.
references:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-04
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.004
  - attack.t1027.010
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1
    Details|contains: "#"
  selection_space_variation:
    Details|contains:
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      - "            "
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL