Windows registry artifactExefile Shell Open Command
Exefile hijack shows e.g. path to a binary
- Threat Hunting
- 2 keys
SOFTWAREUsrClass
Registry keys
2 keys that RECmd reads for this artifact
SOFTWARE(default)Classes\Exefile\Shell\Open\CommandExefile hijack shows e.g. path to a binary
UsrClass(default)Exefile\Shell\Open\CommandExefile hijack shows e.g. path to a binary
References
2 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)