Sigma rule: Potential Persistence Via App Paths Default Property

Rule

Title

Potential Persistence Via App Paths Default Property

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-10

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence
The entries found under App Paths are used primarily for the following purposes.
First, to map an application's executable file name to that file's fully qualified path.
Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths'
    TargetObject|endswith:
        - '(Default)'
        - 'Path'
    Details|contains:
        # Add more suspicious paths or binaries as you see fit.
        - '\Users\Public'
        - '\AppData\Local\Temp\'
        - '\Windows\Temp\'
        - '\Desktop\'
        - '\Downloads\'
        - '%temp%'
        - '%tmp%'
        - 'iex'
        - 'Invoke-'
        - 'rundll32'
        - 'regsvr32'
        - 'mshta'
        - 'cscript'
        - 'wscript'
        - '.bat'
        - '.hta'
        - '.dll'
        - '.ps1'
condition: selection

False positives (as the rule lists them)

• Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1546.012

MITRE ATT&CK ids this rule names

• T1546.012

References

• https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
• https://learn.microsoft.com/en-us/windows/win32/shell/app-registration

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml