Sigma rule: Suspicious Run Key from Download

Rule

Title

Suspicious Run Key from Download

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)

Date

2019-10-01

Modified

2025-02-17

File

rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Log source

product

windows

category

registry_event

Detection

selection:
    Image|contains:
        - '\AppData\Local\Packages\Microsoft.Outlook_'
        - '\AppData\Local\Microsoft\Olk\Attachments\'
        - '\Downloads\'
        - '\Temporary Internet Files\Content.Outlook\'
        - '\Local Settings\Temporary Internet Files\'
    TargetObject|contains:
        - '\Software\Microsoft\Windows\CurrentVersion\Run'
        - '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
        - '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
condition: selection

False positives (as the rule lists them)

• Software installers downloaded and used by users

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

References

• https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
• https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml