Shell Open Registry Keys Manipulation

calendar Sep 1, 2026 · attack.persistence attack.privilege-escalation attack.t1548.002 attack.t1546.001  ·
Share on: linkedin copy

Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile", which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence through file association hijacking.

Sigma rule (View on GitHub)

 1title: Shell Open Registry Keys Manipulation
 2id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7
 3related:
 4    - id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563
 5      type: similar
 6status: test
 7description: |
 8    Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile",
 9    which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence
10    through file association hijacking.    
11references:
12    - https://github.com/hfiref0x/UACME
13    - https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
14    - https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass
15    - https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]
16author: Christian Burkard (Nextron Systems)
17date: 2021-08-30
18modified: 2026-08-27
19tags:
20    - attack.persistence
21    - attack.privilege-escalation
22    - attack.t1548.002
23    - attack.t1546.001
24logsource:
25    category: registry_event
26    product: windows
27detection:
28    selection_1:
29        EventType: SetValue
30        TargetObject|endswith: 'Classes\ms-settings\shell\open\command\SymbolicLinkValue'
31        Details|contains: '\Software\Classes\{'
32    selection_2:
33        TargetObject|endswith: 'Classes\ms-settings\shell\open\command\DelegateExecute'
34    selection_3:
35        EventType: SetValue
36        TargetObject|endswith:
37            - 'Classes\ms-settings\shell\open\command\(Default)'
38            - 'Classes\exefile\shell\open\command\(Default)'
39    filter_main_empty:
40        Details: '(Empty)'
41    filter_main_default_com:
42        Details:
43            - '{4813071a-41ad-44a2-9835-886d2f63ca30}'
44            - '{A56A841F-E974-45C1-8001-7E3F8A085917}'
45            - '{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}'
46            - '{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}'
47    condition: 1 of selection_* and not 1 of filter_main_*
48falsepositives:
49    - Unknown
50level: high

References

Related rules

to-top