User Shell Folders Registry Modification via CommandLine

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

2026-01-05 00:00:00

None

8f3ab69a-aa22-4943-aa58-e0a52fdf6818

attack.persistence attack.privilege-escalation attack.t1547.001 attack.defense-evasion attack.t1112

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5824 from @swachchhanda000 - Update User Shell Folders Registry Modification Rules

2026-01-29