title: Registry Persistence via Explorer Run Key
id: b7916c2a-fa2f-4795-9477-32b731f70f11
status: test
description: Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder
author: Florian Roth, oscd.community
references:
  - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
date: 2018/07/18
modified: 2022/01/13
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    EventType: SetValue 
    TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
  selection2:
    - Details|startswith:
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\'
      - 'C:\$Recycle.bin\'
      - 'C:\Temp\'
      - 'C:\Users\Public\'
      - 'C:\Users\Default\'
    - Details|contains:
      - '\AppData\'
  condition: selection and selection2
fields:
  - Image
  - ParentImage
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.t1547.001
