Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-01-05
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creations where reg.exe or PowerShell is used with command-line actions consistent with adding or setting registry values under the User Shell Folders / Shell Folders keys. It specifically looks for command lines referencing the Shell Folders paths and a Startup-related suffix, which can indicate attempts to influence what runs automatically. The detection relies on Windows process creation telemetry, including the executable image name and command-line contents.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Suspicious NTUSER.MAN Mandatory Profile File Created for Logon Persistence (via file_event)

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-user-shell-folders-value-modification-via-reg-exe-or-powershell-8f3ab69a

title: "Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell"
id: 5df9cbb7-0a22-4810-88bc-54ebd6d2522e
related:
  - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
    type: similar
  - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
    type: derived
status: experimental
description: This rule flags process creations where reg.exe or PowerShell is used with command-line actions consistent with adding or setting registry values under the User Shell Folders / Shell Folders keys. It specifically looks for command lines referencing the Shell Folders paths and a Startup-related suffix, which can indicate attempts to influence what runs automatically. The detection relies on Windows process creation telemetry, including the executable image name and command-line contents.
references:
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1547.001
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
        - reg.exe
  selection_cli_action:
    CommandLine|contains:
      - " add "
      - New-ItemProperty
      - Set-ItemProperty
      - "si "
  selection_cli_paths_root:
    CommandLine|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  selection_cli_paths_suffix:
    CommandLine|contains: Startup
  condition: all of selection_*
falsepositives:
  - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
    technique: T1547.001
    atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL