{"id":"9df5f547-c86a-433e-b533-f2794357e242","title":"Classes Autorun Keys Modification","description":"Detects modification of Windows Registry Classes keys used for persistence.\nAdversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.\nVarious legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,\nthus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\n","author":"Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)","status":"test","level":"medium","date":"2019-10-25","modified":"2025-10-22","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md","https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns","https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d"],"source_path":"rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml","source_sha256":"fa2fc70b95ca258a460e3983307ebb88890aa0d941e9fe5fd3bdc0319d0f9b39","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Classes Autorun Keys Modification\nid: 9df5f547-c86a-433e-b533-f2794357e242\nrelated:\n    - id: 17f878b8-9968-4578-b814-c4217fc5768c\n      type: obsolete\nstatus: test\ndescription: |\n    Detects modification of Windows Registry Classes keys used for persistence.\n    Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.\n    Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,\n    thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns\n    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys\nauthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)\ndate: 2019-10-25\nmodified: 2025-10-22\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_classes_base:\n        TargetObject|contains: '\\Software\\Classes'\n    selection_classes_target:\n        TargetObject|contains:\n            - '\\Folder\\ShellEx\\ExtShellFolderViews'\n            - '\\Folder\\ShellEx\\DragDropHandlers'\n            - '\\Folder\\Shellex\\ColumnHandlers'\n            - '\\Filter'\n            - '\\Exefile\\Shell\\Open\\Command\\(Default)'\n            - '\\Directory\\Shellex\\DragDropHandlers'\n            - '\\Directory\\Shellex\\CopyHookHandlers'\n            - '\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance'\n            - '\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance'\n            - '\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance'\n            - '\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance'\n            - '\\Classes\\AllFileSystemObjects\\ShellEx\\DragDropHandlers'\n            - '\\.exe'\n            - '\\.cmd'\n            - '\\ShellEx\\PropertySheetHandlers'\n            - '\\ShellEx\\ContextMenuHandlers'\n    filter_main_drivers:\n        Image: 'C:\\Windows\\System32\\drvinst.exe'\n    filter_main_empty:\n        Details: '(Empty)'\n    filter_main_null:\n        Details: null\n    filter_main_svchost:\n        Image: 'C:\\Windows\\System32\\svchost.exe'\n        # If more targets are found from \"svchost\". Please exclude the whole image\n        TargetObject|contains: '\\lnkfile\\shellex\\ContextMenuHandlers\\'\n    filter_optional_msoffice:\n        Details: '{807583E5-5146-11D5-A672-00B0D022E945}'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason\n    - Legitimate administrator sets up autorun keys for legitimate reason\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/9df5f547-c86a-433e-b533-f2794357e242.json","kind":"sigma"}