Persistence Via TypedPaths - CommandLine

Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

View on GitHub Open raw file

Detection logic

selection

CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

Condition

selection

Raw YAML

title: Persistence Via TypedPaths - CommandLine
id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba
status: test
description: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt
references:
    - https://twitter.com/dez_/status/1560101453150257154
    - https://forensafe.com/blogs/typedpaths.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-22
tags:
    - attack.persistence
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths'
    condition: selection
falsepositives:
    - Unknown
level: medium

False positives

Unknown

References

Similar rules

Abuse of Service Permissions to Hide Services Via Set-Service

high

windows · Same logsource category (process_creation)

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

high

windows · Same logsource category (process_creation)

APT27 - Emissary Panda Activity

critical

windows · Same logsource category (process_creation)

Attempts of Kerberos Coercion Via DNS SPN Spoofing

high

windows · Same logsource category (process_creation)