Custom File Open Handler Executes PowerShell

Title: Custom File Open Handler Executes PowerShell
Status: test
Description:Detects the abuse of custom file open handler, executing powershell
References:
  -https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728
Author: CD_R0M_
Date: 2022-06-11
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: 'shell\open\command\'
    Details|contains|all:
      -'powershell'
      -'-command'

  condition:selection
Falsepositives:
  -Unknown
Level: high