1200KM / sigma-rule

Registry Tampering by Potentially Suspicious Processes — Sigma Rule

Sigma rule 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2. Registry Tampering by Potentially Suspicious Processes — Sigma Rule. Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: experimental; severity: medium. Source dates: 2025-08-13 / 2026-04-14.

{
  "category": "registry_event",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 4445289b8d53349ca80203a7f4c26441f054030041b4c25a0286cde60f339927

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Registry Tampering by Potentially Suspicious Processes
id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
related:
    - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
      type: similar
    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
      type: similar
status: experimental
description: |
    Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
    These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
    without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-13
modified: 2026-04-14
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        Image|endswith:
            # Add more suspicious processes
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_main_binary_data:
        Details: 'Binary Data'
    filter_main_null:
        Details: null
    filter_main_wscript_legit_1:
        Image|endswith: '\wscript.exe'
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
            - '\Services\bam\State\UserSettings\S-1-'
            - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
            - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
    filter_main_wscript_legit_2:
        Image|endswith: '\wscript.exe'
        TargetObject|contains: '\wscript.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium

Original YAML and metadata in JSON

False positives

Some legitimate admin or install scripts may use these processes for registry modifications.

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.