Detects any deletion of entries in ”.*\shell\open\command” registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could
title: Removal of Potential COM Hijacking Registry Keys
id: 96f697b0-b499-4e5d-9908-a67bec11cdb6
status: test
description: |
Detects any deletion of entries in ".*\shell\open\command" registry keys.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
references:
- https://github.com/OTRF/detection-hackathon-apt29/issues/7
- https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md
- https://learn.microsoft.com/en-us/windows/win32/shell/launch
- https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-05-02
modified: 2025-10-07
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
product: windows
category: registry_delete
detection:
selection:
TargetObject|endswith: '\shell\open\command'
filter_main_explorer:
Image|endswith: 'C:\Windows\explorer.exe'
filter_main_svchost:
Image: 'C:\Windows\system32\svchost.exe'
filter_main_msiexec:
Image:
- 'C:\Windows\System32\msiexec.exe'
- 'C:\Windows\SysWOW64\msiexec.exe'
filter_main_generic_prorams:
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
filter_main_openwith:
Image: 'C:\Windows\System32\OpenWith.exe'
filter_optional_dropbox:
Image|endswith: '\Dropbox.exe'
# We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
TargetObject|contains: '\Dropbox.'
filter_optional_wireshark:
Image|endswith: '\AppData\Local\Temp\Wireshark_uninstaller.exe'
# We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
TargetObject|contains: '\wireshark-capture-file\'
filter_optional_peazip:
Image|contains: 'peazip'
# We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
TargetObject|contains: '\PeaZip.'
filter_optional_everything:
Image|endswith: '\Everything.exe'
# We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
TargetObject|contains: '\Everything.'
filter_optional_uninstallers:
# This image path is linked with different uninstallers when running as admin unfortunately
Image|startswith: 'C:\Windows\Installer\MSI'
filter_optional_java:
Image|startswith: 'C:\Program Files (x86)\Java\'
Image|endswith: '\installer.exe'
TargetObject|contains: '\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'
filter_optional_edgeupdate:
Image|contains: '\Microsoft\EdgeUpdate\Install'
filter_optional_avira:
Image:
- 'C:\Program Files (x86)\Avira\Antivirus\'
- 'C:\Program Files\Avira\Antivirus\'
TargetObject|endswith:
- '\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command'
- '\AntiVir.Keyfile\shell\open\command'
filter_optional_installer_temp:
- Image|contains|all:
- 'AppData\Local\Temp'
- '\setup.exe'
- Image|contains|all:
- '\Temp\is-'
- '\target.tmp'
filter_optional_ninite:
Image|endswith: '\ninite.exe'
filter_optional_discord:
Image|endswith: '\reg.exe'
TargetObject|endswith: '\Discord\shell\open\command'
filter_optional_spotify:
Image|endswith: '\Spotify.exe'
TargetObject|endswith: '\Spotify\shell\open\command'
filter_optional_eclipse:
Image|endswith: 'C:\eclipse\eclipse.exe'
TargetObject|contains: '_Classes\eclipse+'
filter_optional_teamviewer:
Image|contains|all:
- '\Temp'
- '\TeamViewer'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered
level: medium
imRegistry
| where RegistryKey endswith "\\shell\\open\\command" and (not((ActingProcessName endswith "C:\\Windows\\explorer.exe" or ActingProcessName =~ "C:\\Windows\\system32\\svchost.exe" or (ActingProcessName in~ ("C:\\Windows\\System32\\msiexec.exe", "C:\\Windows\\SysWOW64\\msiexec.exe")) or (ActingProcessName startswith "C:\\Program Files\\" or ActingProcessName startswith "C:\\Program Files (x86)\\") or ActingProcessName =~ "C:\\Windows\\System32\\OpenWith.exe"))) and (not(((ActingProcessName endswith "\\Dropbox.exe" and RegistryKey contains "\\Dropbox.") or (ActingProcessName endswith "\\AppData\\Local\\Temp\\Wireshark_uninstaller.exe" and RegistryKey endswith "\\wireshark-capture-file*") or (ActingProcessName contains "peazip" and RegistryKey contains "\\PeaZip.") or (ActingProcessName endswith "\\Everything.exe" and RegistryKey contains "\\Everything.") or ActingProcessName startswith "C:\\Windows\\Installer\\MSI" or (ActingProcessName startswith "C:\\Program Files (x86)\\Java\\" and ActingProcessName endswith "\\installer.exe" and RegistryKey contains "\\Classes\\WOW6432Node\\CLSID\\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}") or ActingProcessName contains "\\Microsoft\\EdgeUpdate\\Install" or ((ActingProcessName in~ ("C:\\Program Files (x86)\\Avira\\Antivirus\\", "C:\\Program Files\\Avira\\Antivirus\\")) and (RegistryKey endswith "\\CLSID\\{305CA226-D286-468e-B848-2B2E8E697B74}\\Shell\\Open\\Command" or RegistryKey endswith "\\AntiVir.Keyfile\\shell\\open\\command")) or ((ActingProcessName contains "AppData\\Local\\Temp" and ActingProcessName contains "\\setup.exe") or (ActingProcessName contains "\\Temp\\is-" and ActingProcessName contains "\\target.tmp")) or ActingProcessName endswith "\\ninite.exe" or (ActingProcessName endswith "\\reg.exe" and RegistryKey endswith "\\Discord\\shell\\open\\command") or (ActingProcessName endswith "\\Spotify.exe" and RegistryKey endswith "\\Spotify\\shell\\open\\command") or (ActingProcessName endswith "C:\\eclipse\\eclipse.exe" and RegistryKey contains "_Classes\\eclipse+") or (ActingProcessName contains "\\Temp" and ActingProcessName contains "\\TeamViewer"))))| Sentinel Table | Notes |
|---|---|
imRegistry | Ensure this data connector is enabled |