Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

title: "Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell"
id: 5df9cbb7-0a22-4810-88bc-54ebd6d2522e
related:
  - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
    type: similar
  - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
    type: derived
status: experimental
description: This rule flags process creations where reg.exe or PowerShell is used with command-line actions consistent with adding or setting registry values under the User Shell Folders / Shell Folders keys. It specifically looks for command lines referencing the Shell Folders paths and a Startup-related suffix, which can indicate attempts to influence what runs automatically. The detection relies on Windows process creation telemetry, including the executable image name and command-line contents.
references:
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1547.001
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
        - reg.exe
  selection_cli_action:
    CommandLine|contains:
      - " add "
      - New-ItemProperty
      - Set-ItemProperty
      - "si "
  selection_cli_paths_root:
    CommandLine|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  selection_cli_paths_suffix:
    CommandLine|contains: Startup
  condition: all of selection_*
falsepositives:
  - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
    technique: T1547.001
    atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
license: DRL-1.1