Sigma rule: VBScript Payload Stored in Registry

Rule

Title

VBScript Payload Stored in Registry

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2021-03-05

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: 'Software\Microsoft\Windows\CurrentVersion'
    Details|contains:
        - 'vbscript:'
        - 'jscript:'
        - 'mshtml,'
        - 'RunHTMLApplication'
        - 'Execute('
        - 'CreateObject'
        - 'window.close'
filter:
    TargetObject|contains: 'Software\Microsoft\Windows\CurrentVersion\Run'
filter_dotnet:
    Image|endswith: '\msiexec.exe'
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\'
    Details|contains:
        - '\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll'
        - '<\Microsoft.mshtml,fileVersion='
        - '_mshtml_dll_'
        - '<\Microsoft.mshtml,culture='
condition: selection and not 1 of filter*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

References

• https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml