{"id":"7530b96f-ad8e-431d-a04d-ac85cc461fdc","title":"Custom File Open Handler Executes PowerShell","description":"Detects the abuse of custom file open handler, executing powershell","author":"CD_R0M_","status":"test","level":"high","date":"2022-06-11","modified":"2023-08-17","tags":["attack.stealth","attack.t1202"],"technique_ids":["T1202"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728"],"source_path":"rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml","source_sha256":"b9adfed25e6fe2a6a03d8741fca59d48517cbc0d7aab085e45174abda2832fe5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Custom File Open Handler Executes PowerShell\nid: 7530b96f-ad8e-431d-a04d-ac85cc461fdc\nstatus: test\ndescription: Detects the abuse of custom file open handler, executing powershell\nreferences:\n    - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728\nauthor: CD_R0M_\ndate: 2022-06-11\nmodified: 2023-08-17\ntags:\n    - attack.stealth\n    - attack.t1202\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: 'shell\\open\\command\\'\n        Details|contains|all:\n            - 'powershell'\n            - '-command'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/7530b96f-ad8e-431d-a04d-ac85cc461fdc.json","kind":"sigma"}