Sigma rule: Potential Persistence Via Disk Cleanup Handler - Registry

Rule

Title

Potential Persistence Via Disk Cleanup Handler - Registry

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-21

Modified

2023-02-07

File

rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence.
The disk cleanup manager is part of the operating system. It displays the dialog box […]
The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Log source

product

windows

category

registry_add

Detection

selection:
    EventType: CreateKey
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\'
filter_main_default_keys:
    # Default Keys
    TargetObject|endswith:
        - '\Active Setup Temp Folders'
        - '\BranchCache'
        - '\Content Indexer Cleaner'
        - '\D3D Shader Cache'
        - '\Delivery Optimization Files'
        - '\Device Driver Packages'
        - '\Diagnostic Data Viewer database files'
        - '\Downloaded Program Files'
        - '\DownloadsFolder'
        - '\Feedback Hub Archive log files'
        - '\Internet Cache Files'
        - '\Language Pack'
        - '\Microsoft Office Temp Files'
        - '\Offline Pages Files'
        - '\Old ChkDsk Files'
        - '\Previous Installations'
        - '\Recycle Bin'
        - '\RetailDemo Offline Content'
        - '\Setup Log Files'
        - '\System error memory dump files'
        - '\System error minidump files'
        - '\Temporary Files'
        - '\Temporary Setup Files'
        - '\Temporary Sync Files'
        - '\Thumbnail Cache'
        - '\Update Cleanup'
        - '\Upgrade Discarded Files'
        - '\User file versions'
        - '\Windows Defender'
        - '\Windows Error Reporting Files'
        - '\Windows ESD installation files'
        - '\Windows Upgrade Log Files'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate new entry added by windows

Tags

• attack.persistence

References

• https://persistence-info.github.io/Data/diskcleanuphandler.html
• https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml