Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders

Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.

FreeUnreviewedSigmahighv1

windows-suspicious-run-key-created-from-downloads-or-outlook-ie-temporary-folder-9c5037d1

title: Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders
id: 3e87458e-70a2-40ed-8b3c-2788c5aa6846
status: test
description: This rule flags registry Run key creations where the writing process image path contains common user download and temporary Outlook or Internet Explorer directories. Attackers abuse Run and policy Run keys to establish persistence by launching code at user logon. It relies on Windows registry event telemetry, matching both the process image path substrings and the TargetObject paths for Run locations, including 64-bit, WOW6432Node, and Explorer policy Run keys.
references:
  - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems), Huntrule Team
date: 2019-10-01
modified: 2025-02-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    Image|contains:
      - \AppData\Local\Packages\Microsoft.Outlook_
      - \AppData\Local\Microsoft\Olk\Attachments\
      - \Downloads\
      - \Temporary Internet Files\Content.Outlook\
      - \Local Settings\Temporary Internet Files\
    TargetObject|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Run
      - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
      - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  condition: selection
falsepositives:
  - Software installers downloaded and used by users
level: high
license: DRL-1.1
related:
  - id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be
    type: derived

What it detects

This rule flags registry Run key creations where the writing process image path contains common user download and temporary Outlook or Internet Explorer directories. Attackers abuse Run and policy Run keys to establish persistence by launching code at user logon. It relies on Windows registry event telemetry, matching both the process image path substrings and the TargetObject paths for Run locations, including 64-bit, WOW6432Node, and Explorer policy Run keys.

Known false positives

Software installers downloaded and used by users

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.