{"id":"96f697b0-b499-4e5d-9908-a67bec11cdb6","title":"Removal of Potential COM Hijacking Registry Keys","description":"Detects any deletion of entries in \".*\\shell\\open\\command\" registry keys.\nThese registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2025-10-07","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"product":"windows","category":"registry_delete"},"falsepositives":["Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered"],"references":["https://github.com/OTRF/detection-hackathon-apt29/issues/7","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md","https://learn.microsoft.com/en-us/windows/win32/shell/launch","https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand","https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code"],"source_path":"rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml","source_sha256":"334ff2d7a7283e4812a69c5fc309634c41e36ea38f46e32bab352dced72bc7d6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Removal of Potential COM Hijacking Registry Keys\nid: 96f697b0-b499-4e5d-9908-a67bec11cdb6\nstatus: test\ndescription: |\n    Detects any deletion of entries in \".*\\shell\\open\\command\" registry keys.\n    These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.\nreferences:\n    - https://github.com/OTRF/detection-hackathon-apt29/issues/7\n    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md\n    - https://learn.microsoft.com/en-us/windows/win32/shell/launch\n    - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand\n    - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-05-02\nmodified: 2025-10-07\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    product: windows\n    category: registry_delete\ndetection:\n    selection:\n        TargetObject|endswith: '\\shell\\open\\command'\n    filter_main_explorer:\n        Image|endswith: 'C:\\Windows\\explorer.exe'\n    filter_main_svchost:\n        Image: 'C:\\Windows\\system32\\svchost.exe'\n    filter_main_msiexec:\n        Image:\n            - 'C:\\Windows\\System32\\msiexec.exe'\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n    filter_main_generic_prorams:\n        Image|startswith:\n            - 'C:\\Program Files\\'\n            - 'C:\\Program Files (x86)\\'\n    filter_main_openwith:\n        Image: 'C:\\Windows\\System32\\OpenWith.exe'\n    filter_optional_dropbox:\n        Image|endswith: '\\Dropbox.exe'\n        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)\n        TargetObject|contains: '\\Dropbox.'\n    filter_optional_wireshark:\n        Image|endswith: '\\AppData\\Local\\Temp\\Wireshark_uninstaller.exe'\n        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)\n        TargetObject|contains: '\\wireshark-capture-file\\'\n    filter_optional_peazip:\n        Image|contains: 'peazip'\n        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)\n        TargetObject|contains: '\\PeaZip.'\n    filter_optional_everything:\n        Image|endswith: '\\Everything.exe'\n        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)\n        TargetObject|contains: '\\Everything.'\n    filter_optional_uninstallers:\n        # This image path is linked with different uninstallers when running as admin unfortunately\n        Image|startswith: 'C:\\Windows\\Installer\\MSI'\n    filter_optional_java:\n        Image|startswith: 'C:\\Program Files (x86)\\Java\\'\n        Image|endswith: '\\installer.exe'\n        TargetObject|contains: '\\Classes\\WOW6432Node\\CLSID\\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'\n    filter_optional_edgeupdate:\n        Image|contains: '\\Microsoft\\EdgeUpdate\\Install'\n    filter_optional_avira:\n        Image:\n            - 'C:\\Program Files (x86)\\Avira\\Antivirus\\'\n            - 'C:\\Program Files\\Avira\\Antivirus\\'\n        TargetObject|endswith:\n            - '\\CLSID\\{305CA226-D286-468e-B848-2B2E8E697B74}\\Shell\\Open\\Command'\n            - '\\AntiVir.Keyfile\\shell\\open\\command'\n    filter_optional_installer_temp:\n        - Image|contains|all:\n              - 'AppData\\Local\\Temp'\n              - '\\setup.exe'\n        - Image|contains|all:\n              - '\\Temp\\is-'\n              - '\\target.tmp'\n    filter_optional_ninite:\n        Image|endswith: '\\ninite.exe'\n    filter_optional_discord:\n        Image|endswith: '\\reg.exe'\n        TargetObject|endswith: '\\Discord\\shell\\open\\command'\n    filter_optional_spotify:\n        Image|endswith: '\\Spotify.exe'\n        TargetObject|endswith: '\\Spotify\\shell\\open\\command'\n    filter_optional_eclipse:\n        Image|endswith: 'C:\\eclipse\\eclipse.exe'\n        TargetObject|contains: '_Classes\\eclipse+'\n    filter_optional_teamviewer:\n        Image|contains|all:\n            - '\\Temp'\n            - '\\TeamViewer'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/96f697b0-b499-4e5d-9908-a67bec11cdb6.json","kind":"sigma"}