Shell Open Registry Keys Manipulation

SigmaHQ Detections@sigmaHQ

•updated Aug 27, 2026•0•0•0

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)