Sigma Rule Library

Shell Context Menu Command Tampering

Detects changes to shell context menu commands. Use this rule to hunt for potential anomalies and suspicious shell commands.

View on GitHubOpen raw file

Detection logic

selection

TargetObject|contains|all:
  - \Software\Classes\
  - \shell\
  - \command\

Condition

selection

Raw YAML

title: Shell Context Menu Command Tampering
id: 868df2d1-0939-4562-83a7-27408c4a1ada
status: test
description: Detects changes to shell context menu commands. Use this rule to hunt for potential anomalies and suspicious shell commands.
references:
    - https://mrd0x.com/sentinelone-persistence-via-menu-context/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-03-06
tags:
    - attack.persistence
    - detection.threat-hunting
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Software\Classes\'
            - '\shell\'
            - '\command\'
    condition: selection
falsepositives:
    - Likely from new software installation suggesting to add context menu items. Such as "PowerShell", "Everything", "Git", etc.
level: low

False positives

  • Likely from new software installation suggesting to add context menu items. Such as "PowerShell", "Everything", "Git", etc.

References

Similar rules

Microsoft Office Trusted Location Updated

medium

windows · Same logsource category (registry_set)

Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace

medium

windows · Same logsource category (registry_set)

Service Binary in User Controlled Folder

medium

windows · Same logsource category (registry_set)

Activate Suppression of Windows Security Center Notifications

medium

windows · Same logsource category (registry_set)