Rule Info
Name
System-Wide Windir or SystemRoot Environment Variable Tampering via Registry
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects modifications to the system-wide windir or SystemRoot environment variables.
Attackers may redirect these variables to a malicious directory to hijack execution of processes that rely on them, enabling privilege escalation or persistence.
Date
2026-09-23 00:00:00
Modified
None
Id
13d611ee-2e5b-42aa-aef1-aef53aa5965b
Tags
attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.007
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR