{"id":"2a0a169d-cc66-43ce-9ae2-6e678e54e46a","title":"Registry Modification Attempt Via VBScript - PowerShell","description":"Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods embedded within PowerShell scripts or commands.\nThreat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.\nThis technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":"","tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"technique_ids":["T1059.005","T1112"],"logsource":{"category":"ps_script","product":"windows"},"falsepositives":["Some legitimate admin or install scripts may use these processes for registry modifications."],"references":["https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/","https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml","source_sha256":"03a27cb4427ec5fb1f9abbf24e776e4f31cc3e85909e17c9625525c3f7b6e187","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Registry Modification Attempt Via VBScript - PowerShell\nid: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a\nrelated:\n    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf\n      type: similar\n    - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2\n      type: similar\nstatus: experimental\ndescription: |\n    Detects attempts to modify the registry using VBScript's CreateObject(\"Wscript.shell\") and RegWrite methods embedded within PowerShell scripts or commands.\n    Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.\n    This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.\nreferences:\n    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/\n    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/\n    - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad\ndate: 2025-08-13\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1112\n    - attack.t1059.005\nlogsource:\n    category: ps_script\n    product: windows\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - 'CreateObject'\n            - 'Wscript.shell'\n            - '.RegWrite'\n    condition: selection\nfalsepositives:\n    - Some legitimate admin or install scripts may use these processes for registry modifications.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/2a0a169d-cc66-43ce-9ae2-6e678e54e46a.json","kind":"sigma"}