AN0170
Analytic 0170
Windows
Detects modification of registry keys used for default file handlers, followed by anomalous process execution from user-initiated file opens. This includes tracking changes under HKCU and HKCR for file extension mappings, and correlating them with new or suspicious handler paths launching unusual child processes (e.g., PowerShell, cmd, wscript).
WinEventLog:Sysmon
EventCode=13, 14
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4672
[TimeWindow]
Defines how long after the registry modification to correlate a suspicious process execution
[UserContext]
Tune to ignore known admin or installer behavior in specific user profiles
[SuspiciousHandlerPathRegex]
Pattern match for suspicious handler paths (e.g., powershell.exe, rundll32.exe)