Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.