Sigma rule: Persistence Via Disk Cleanup Handler - Autorun

Rule

Title

Persistence Via Disk Cleanup Handler - Autorun

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-21

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Log source

product

windows

category

registry_set

Detection

root:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\'
selection_autorun:
    # Launching PreCleanupString / CleanupString programs w/o gui, i.e. while using e.g. /autoclean
    TargetObject|contains: '\Autorun'
    Details: 'DWORD (0x00000001)'
selection_pre_after:
    TargetObject|contains:
        - '\CleanupString'
        - '\PreCleanupString'
    Details|contains:
        # Add more as you see fit
        - 'cmd'
        - 'powershell'
        - 'rundll32'
        - 'mshta'
        - 'cscript'
        - 'wscript'
        - 'wsl'
        - '\Users\Public\'
        - '\Windows\TEMP\'
        - '\Microsoft\Windows\Start Menu\Programs\Startup\'
condition: root and 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence

References

• https://persistence-info.github.io/Data/diskcleanuphandler.html
• https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml