Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-01-05
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creations where reg.exe or PowerShell is used with command-line actions consistent with adding or setting registry values under the User Shell Folders / Shell Folders keys. It specifically looks for command lines referencing the Shell Folders paths and a Startup-related suffix, which can indicate attempts to influence what runs automatically. The detection relies on Windows process creation telemetry, including the executable image name and command-line contents.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Suspicious NTUSER.MAN Mandatory Profile File Created for Logon Persistence (via file_event)

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Suspicious Registry Value under Console WindowsUpdates for C2 Storage

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)

Suspicious NetSupport client32 Persistence via Run Key from ProgramData

Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-user-shell-folders-value-modification-via-reg-exe-or-powershell-8f3ab69a

title: "Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell"
id: 5df9cbb7-0a22-4810-88bc-54ebd6d2522e
related:
  - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
    type: similar
  - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
    type: derived
status: experimental
description: This rule flags process creations where reg.exe or PowerShell is used with command-line actions consistent with adding or setting registry values under the User Shell Folders / Shell Folders keys. It specifically looks for command lines referencing the Shell Folders paths and a Startup-related suffix, which can indicate attempts to influence what runs automatically. The detection relies on Windows process creation telemetry, including the executable image name and command-line contents.
references:
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1547.001
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
        - reg.exe
  selection_cli_action:
    CommandLine|contains:
      - " add "
      - New-ItemProperty
      - Set-ItemProperty
      - "si "
  selection_cli_paths_root:
    CommandLine|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  selection_cli_paths_suffix:
    CommandLine|contains: Startup
  condition: all of selection_*
falsepositives:
  - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
    technique: T1547.001
    atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL