Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders
Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.
- Product
- windows
- Category
- registry_event
- Author
- Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry Run key creations where the writing process image path contains common user download and temporary Outlook or Internet Explorer directories. Attackers abuse Run and policy Run keys to establish persistence by launching code at user logon. It relies on Windows registry event telemetry, matching both the process image path substrings and the TargetObject paths for Run locations, including 64-bit, WOW6432Node, and Explorer policy Run keys.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
- github.comhttps://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders
id: 3e87458e-70a2-40ed-8b3c-2788c5aa6846
status: test
description: This rule flags registry Run key creations where the writing process image path contains common user download and temporary Outlook or Internet Explorer directories. Attackers abuse Run and policy Run keys to establish persistence by launching code at user logon. It relies on Windows registry event telemetry, matching both the process image path substrings and the TargetObject paths for Run locations, including 64-bit, WOW6432Node, and Explorer policy Run keys.
references:
- https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems), Huntrule Team
date: 2019-10-01
modified: 2025-02-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
category: registry_event
product: windows
detection:
selection:
Image|contains:
- \AppData\Local\Packages\Microsoft.Outlook_
- \AppData\Local\Microsoft\Olk\Attachments\
- \Downloads\
- \Temporary Internet Files\Content.Outlook\
- \Local Settings\Temporary Internet Files\
TargetObject|contains:
- \Software\Microsoft\Windows\CurrentVersion\Run
- \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
- \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
condition: selection
falsepositives:
- Software installers downloaded and used by users
level: high
license: DRL-1.1
related:
- id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be
type: derived