Potential Persistence Via TypedPaths Registry Key
This rule detects modifications or additions to the 'TypedPaths' registry key, which is used by Windows Explorer to store recently typed paths in the Run dialog and File Explorer address bar. Adversaries can leverage this key for persistence by injecting malicious paths that get executed when a user interacts with these features. The rule specifically filters out modifications made by the legitimate 'explorer.exe' process to reduce false positives, focusing on non-standard applications attempting to modify this key.
Sigma
