Sigma rule: Removal of Potential COM Hijacking Registry Keys

Rule

Title

Removal of Potential COM Hijacking Registry Keys

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2020-05-02

Modified

2025-10-07

File

rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects any deletion of entries in ".*\shell\open\command" registry keys.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Log source

product

windows

category

registry_delete

Detection

selection:
    TargetObject|endswith: '\shell\open\command'
filter_main_explorer:
    Image|endswith: 'C:\Windows\explorer.exe'
filter_main_svchost:
    Image: 'C:\Windows\system32\svchost.exe'
filter_main_msiexec:
    Image:
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
filter_main_generic_prorams:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_openwith:
    Image: 'C:\Windows\System32\OpenWith.exe'
filter_optional_dropbox:
    Image|endswith: '\Dropbox.exe'
    # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
    TargetObject|contains: '\Dropbox.'
filter_optional_wireshark:
    Image|endswith: '\AppData\Local\Temp\Wireshark_uninstaller.exe'
    # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
    TargetObject|contains: '\wireshark-capture-file\'
filter_optional_peazip:
    Image|contains: 'peazip'
    # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
    TargetObject|contains: '\PeaZip.'
filter_optional_everything:
    Image|endswith: '\Everything.exe'
    # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
    TargetObject|contains: '\Everything.'
filter_optional_uninstallers:
    # This image path is linked with different uninstallers when running as admin unfortunately
    Image|startswith: 'C:\Windows\Installer\MSI'
filter_optional_java:
    Image|startswith: 'C:\Program Files (x86)\Java\'
    Image|endswith: '\installer.exe'
    TargetObject|contains: '\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'
filter_optional_edgeupdate:
    Image|contains: '\Microsoft\EdgeUpdate\Install'
filter_optional_avira:
    Image:
        - 'C:\Program Files (x86)\Avira\Antivirus\'
        - 'C:\Program Files\Avira\Antivirus\'
    TargetObject|endswith:
        - '\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command'
        - '\AntiVir.Keyfile\shell\open\command'
filter_optional_installer_temp:
    - Image|contains|all:
          - 'AppData\Local\Temp'
          - '\setup.exe'
    - Image|contains|all:
          - '\Temp\is-'
          - '\target.tmp'
filter_optional_ninite:
    Image|endswith: '\ninite.exe'
filter_optional_discord:
    Image|endswith: '\reg.exe'
    TargetObject|endswith: '\Discord\shell\open\command'
filter_optional_spotify:
    Image|endswith: '\Spotify.exe'
    TargetObject|endswith: '\Spotify\shell\open\command'
filter_optional_eclipse:
    Image|endswith: 'C:\eclipse\eclipse.exe'
    TargetObject|contains: '_Classes\eclipse+'
filter_optional_teamviewer:
    Image|contains|all:
        - '\Temp'
        - '\TeamViewer'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

References

• https://github.com/OTRF/detection-hackathon-apt29/issues/7
• https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md
• https://learn.microsoft.com/en-us/windows/win32/shell/launch
• https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
• https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml