User Shell Folders Registry Modification via CommandLine

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · GPL-2.0

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

title: User Shell Folders Registry Modification via CommandLine
id: 5420089b-141a-40bb-bbab-6f6bbce66d29
related:
    - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
      type: similar
    - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
      type: derived
status: experimental
description: |
    Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.
    Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.
    This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.
references:
    - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-01-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1547.001
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_img:
        - NewProcessName|endswith:
              - \powershell.exe
              - \pwsh.exe
              - \reg.exe
        - OriginalFileName:
              - powershell.exe
              - pwsh.dll
              - reg.exe
    selection_cli_action:
        CommandLine|contains:
            - ' add ' # reg.exe modification
            - New-ItemProperty
            - Set-ItemProperty
            - 'si ' # short for Set-ItemProperty
    selection_cli_paths_root:
        CommandLine|contains:
            - \Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
            - \Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
    selection_cli_paths_suffix:
        CommandLine|contains: Startup   # covers both 'Startup' and 'Common Startup'
    condition: process_creation and (all of selection_*)
falsepositives:
    - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml
simulation:
    - type: atomic-red-team
      name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
      technique: T1547.001
      atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2067666b-6056-47c2-a28e-6d7ff020388b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion