
title: Shell Open Registry Keys Manipulation
author: Christian Burkard
date: 2021/08/30
description: Detects the shell open key manipulation (exefile and ms-settings) used
  for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe,
  slui.exe via registry keys (e.g. UACMe 33 or 62)
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_10:
    TargetObject:
    - '*Classes\ms-settings\shell\open\command\(Default)'
    - '*Classes\exefile\shell\open\command\(Default)'
  SELECTION_11:
    Details: (Empty)
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*Classes\ms-settings\shell\open\command\SymbolicLinkValue'
  SELECTION_5:
    Details: '*\Software\Classes\{*'
  SELECTION_6:
    TargetObject: '*Classes\ms-settings\shell\open\command\DelegateExecute'
  SELECTION_7:
    EventID: 12
  SELECTION_8:
    EventID: 13
  SELECTION_9:
    EventID: 14
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and (((SELECTION_4 and SELECTION_5)
    or SELECTION_6) or ((SELECTION_7 or SELECTION_8 or SELECTION_9) and SELECTION_10
    and  not (SELECTION_11))))
falsepositives:
- Unknown
id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7
level: high
logsource:
  category: registry_event
  product: windows
modified: 2021/11/19
references:
- https://github.com/hfiref0x/UACME
- https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
- https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass
- https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]
status: experimental
tags:
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1548.002
- attack.t1546.001
ruletype: SIGMA
