{"id":"8f3ab69a-aa22-4943-aa58-e0a52fdf6818","title":"User Shell Folders Registry Modification via CommandLine","description":"Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.\nAttackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.\nThis technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-05","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1547.001","attack.t1112"],"technique_ids":["T1112","T1547.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare."],"references":["https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"],"source_path":"rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml","source_sha256":"fadd6a4a171e8a6e858a7853a6028f6ebb0b634777931287baaafaf3669bbfa0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: User Shell Folders Registry Modification via CommandLine\nid: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818\nrelated:\n    - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc\n      type: similar\nstatus: experimental\ndescription: |\n    Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.\n    Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.\n    This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.\nreferences:\n    - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-01-05\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.defense-impairment\n    - attack.t1547.001\n    - attack.t1112\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\reg.exe'\n        - OriginalFileName:\n              - 'powershell.exe'\n              - 'pwsh.dll'\n              - 'reg.exe'\n    selection_cli_action:\n        CommandLine|contains:\n            - ' add ' # reg.exe modification\n            - 'New-ItemProperty'\n            - 'Set-ItemProperty'\n            - 'si ' # short for Set-ItemProperty\n    selection_cli_paths_root:\n        CommandLine|contains:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders'\n    selection_cli_paths_suffix:\n        CommandLine|contains: 'Startup' # covers both 'Startup' and 'Common Startup'\n    condition: all of selection_*\nfalsepositives:\n    - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value\n      technique: T1547.001\n      atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/8f3ab69a-aa22-4943-aa58-e0a52fdf6818.json","kind":"sigma"}