Hayabusa high test sigma

Shell Open Registry Keys Manipulation

Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile", which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence through file association hijacking.

View Source

Detection Logic

{
  "registry_event": {
    "EventID": [
      12,
      13,
      14
    ],
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_1": {
    "EventType": "SetValue",
    "TargetObject
| endswith": "Classes\\ms-settings\\shell\\open\\command\\SymbolicLinkValue",
    "Details
| contains": "\\Software\\Classes\\{"
  },
  "selection_2": {
    "TargetObject
| endswith": "Classes\\ms-settings\\shell\\open\\command\\DelegateExecute"
  },
  "selection_3": {
    "EventType": "SetValue",
    "TargetObject
| endswith": [
      "Classes\\ms-settings\\shell\\open\\command\\(Default)",
      "Classes\\exefile\\shell\\open\\command\\(Default)"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_default_com": {
    "Details": [
      "{4813071a-41ad-44a2-9835-886d2f63ca30}",
      "{A56A841F-E974-45C1-8001-7E3F8A085917}",
      "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
      "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
    ]
  },
  "condition": "registry_event and (1 of selection_* and not 1 of filter_main_*)"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...