high advisory November 13, 2026

Windows Registry Shell Open Key Manipulation

Malicious actors modify shell open command registry keys to achieve UAC bypass or maintain persistence through file association hijacking.

Triage facts

Revision 1

Applicability: Windows
Evidence: Unknown
Severity: High
Sources: 5 public sources
Freshness: Revision 1Nov 13, 06:51 UTC
Detection: 1 rule
Source quality: A2Roughly even chance

Threat actors target Windows shell open command registry keys, such as "ms-settings" and "exefile", to facilitate User Account Control (UAC) bypass or to establish persistent execution via file association hijacking.

Impact

Successful manipulation of these keys allows for privilege escalation to administrative levels or the establishment of long-term persistence within the host environment.

Recommendation

Monitor registry events for unauthorized modifications to the identified shell open command keys.

Detection coverage 1

Detect Shell Open Registry Keys Manipulation

high

Detects manipulation of shell open command registry keys such as 'ms-settings' and 'exefile', which are commonly abused to achieve UAC bypass or establish persistence through file association hijacking.

sigma sources: registry_event, windows

Detection queries are available on the platform. Get full rules →

Affected

Operating systems

Windows

References

MITRE ATT&CK

T1548.002 · TA0004

Bypass User Account Control

Privilege Escalation

Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile", which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence through file association hijacking.

T1546.001 · TA0003

Change Default File Association

Persistence

Detects manipulation of shell open command registry keys such as "ms-settings" and "exefile", which are commonly abused to achieve UAC bypass (e.g. via fodhelper.exe) or establish persistence through file association hijacking.