{"id":"7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2","title":"Registry Tampering by Potentially Suspicious Processes","description":"Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.\nThese processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry\nwithout using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-08-13","modified":"2026-04-14","tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1059.005"],"technique_ids":["T1059.005","T1112"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Some legitimate admin or install scripts may use these processes for registry modifications."],"references":["https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/","https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/"],"source_path":"rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml","source_sha256":"4445289b8d53349ca80203a7f4c26441f054030041b4c25a0286cde60f339927","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Registry Tampering by Potentially Suspicious Processes\nid: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2\nrelated:\n    - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a\n      type: similar\n    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.\n    These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry\n    without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.\nreferences:\n    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/\n    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-08-13\nmodified: 2026-04-14\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1112\n    - attack.t1059.005\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            # Add more suspicious processes\n            - '\\mshta.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n    filter_main_binary_data:\n        Details: 'Binary Data'\n    filter_main_null:\n        Details: null\n    filter_main_wscript_legit_1:\n        Image|endswith: '\\wscript.exe'\n        TargetObject|contains:\n            - 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data\\'\n            - '\\Services\\bam\\State\\UserSettings\\S-1-'\n            - 'Software\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe\\'\n            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\'\n    filter_main_wscript_legit_2:\n        Image|endswith: '\\wscript.exe'\n        TargetObject|contains: '\\wscript.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Some legitimate admin or install scripts may use these processes for registry modifications.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2.json","kind":"sigma"}