Sigma rule: Shell Open Registry Keys Manipulation

Rule

Title

Shell Open Registry Keys Manipulation

Status

test

Level

high

Author

Christian Burkard (Nextron Systems)

Date

2021-08-30

Modified

2026-08-27

File

rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile",
which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence
through file association hijacking.

Log source

product

windows

category

registry_event

Detection

selection_1:
    EventType: SetValue
    TargetObject|endswith: 'Classes\ms-settings\shell\open\command\SymbolicLinkValue'
    Details|contains: '\Software\Classes\{'
selection_2:
    TargetObject|endswith: 'Classes\ms-settings\shell\open\command\DelegateExecute'
selection_3:
    EventType: SetValue
    TargetObject|endswith:
        - 'Classes\ms-settings\shell\open\command\(Default)'
        - 'Classes\exefile\shell\open\command\(Default)'
filter_main_empty:
    Details: '(Empty)'
filter_main_default_com:
    Details:
        - '{4813071a-41ad-44a2-9835-886d2f63ca30}'
        - '{A56A841F-E974-45C1-8001-7E3F8A085917}'
        - '{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}'
        - '{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}'
condition: 1 of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1548.002
• attack.t1546.001

MITRE ATT&CK ids this rule names

• T1546.001
• T1548.002

Related rules

• dd3ee8cc-f751-41c9-ba53-5a32ed47e563 (similar)

References

• https://github.com/hfiref0x/UACME
• https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
• https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass
• https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml