Suspicious Shell Open Command Registry Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.

2026-01-24 00:00:00

None

9e8894c0-0ae0-11ef-9d85-1f2942bec57c

attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1548.002 attack.t1546.001

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5487 from @swachchhanda000 - Update Registry Shell Open Related Rules

2026-01-24