Abuse of Shell Open Registry Keys for Persistence and UAC Bypass

Windows shell open registry keys, specifically those under "ms-settings" and "exefile", represent a critical surface for privilege escalation and persistence. Attackers manipulate these keys to hijack file associations or exploit high-integrity processes that trust these registry locations, such as fodhelper.exe. By injecting custom commands or symbolic links into these paths, attackers can force the operating system to execute arbitrary payloads with elevated privileges or upon specific system triggers. This technique is well-documented in UAC bypass research and has been observed in various malware campaigns, including infostealers like Lokibot. Defenders must monitor these registry paths for unauthorized modifications, as they are rarely changed by legitimate administrative activity.

Attack Chain

1. Attacker gains initial access to the target system as a low-privileged user.
2. Attacker identifies a target registry key (e.g., HKCU\Software\Classes\ms-settings\shell\open\command) for manipulation.
3. Attacker modifies the "(Default)" value or adds a "DelegateExecute" entry to the targeted registry key.
4. Attacker inserts a path to a malicious executable or a command string into the registry value.
5. Attacker triggers a legitimate high-integrity process (e.g., fodhelper.exe) that queries the hijacked registry key.
6. The system executes the attacker-controlled path due to the hijacked association.
7. Attacker achieves local privilege escalation or established persistence under the security context of the triggered process.

Impact

Successful manipulation of these keys allows adversaries to bypass UAC prompts, enabling them to execute malicious code in high-integrity contexts without user consent. This capability is frequently used to escalate privileges, deploy persistent backdoors, and maintain long-term access to compromised systems, significantly increasing the risk of widespread data exfiltration and ransomware deployment.

Recommendation

Deploy the provided Sigma rule to monitor for unauthorized modifications to shell open registry keys. Prioritize alerting on writes to the specified paths, excluding known-good COM object CLSIDs that are used by legitimate system functions.