Rule Info
Name
Non-Standard System-Wide Windir or SystemRoot Environment Variable
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects system-wide windir or SystemRoot environment variables set to a non-standard value.
Attackers may redirect these variables to a malicious directory to hijack execution of processes that rely on them, enabling privilege escalation or persistence.
Date
2026-09-23 00:00:00
Modified
None
Id
8d649d3b-e605-4c8c-ae70-eb70478cfac8
Tags
attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.007
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR