Sigma rule: Registry Modification Attempt Via VBScript - PowerShell

Rule

Title

Registry Modification Attempt Via VBScript - PowerShell

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-08-13

File

rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands.
Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.

Log source

product

windows

category

ps_script

Detection

selection:
    ScriptBlockText|contains|all:
        - 'CreateObject'
        - 'Wscript.shell'
        - '.RegWrite'
condition: selection

False positives (as the rule lists them)

• Some legitimate admin or install scripts may use these processes for registry modifications.

Tags

• attack.persistence
• attack.execution
• attack.defense-impairment
• attack.t1112
• attack.t1059.005

MITRE ATT&CK ids this rule names

• T1059.005
• T1112

Related rules

• 921aa10f-2e74-4cca-9498-98f9ca4d6fdf (similar)
• 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 (similar)

References

• https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
• https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
• https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml