{"id":"9c226817-8dc9-46c2-a58d-66655aafd7dc","title":"Modify User Shell Folders Startup Value","description":"Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.\nAttackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.\nThis technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.\n","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2022-10-01","modified":"2026-01-05","tags":["attack.persistence","attack.privilege-escalation","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md","https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"],"source_path":"rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml","source_sha256":"adad4dbd92a37bdc46a2a157dda8dd55ae41e23732f68820ddfc85b2832064fe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Modify User Shell Folders Startup Value\nid: 9c226817-8dc9-46c2-a58d-66655aafd7dc\nrelated:\n    - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818\n      type: similar\nstatus: test\ndescription: |\n    Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.\n    Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.\n    This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md\n    - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/\nauthor: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2022-10-01\nmodified: 2026-01-05\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.001\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        TargetObject|contains:\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders'\n        TargetObject|endswith:\n            - '\\Common Startup'\n            - '\\Startup'\n    filter_main_details_null:\n        Details: null\n    filter_main_programdata_startup:\n        Details|contains:\n            - 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n            - '%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n    filter_main_userprofile_startup_1:\n        Details|contains:\n            - '%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n            - '%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n    filter_main_userprofile_startup_2:\n        Details|contains|all:\n            - 'C:\\Users\\'\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n    # Apply more filters if new legitimate paths are identified\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value\n      technique: T1547.001\n      atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/9c226817-8dc9-46c2-a58d-66655aafd7dc.json","kind":"sigma"}