Sigma rule: Registry Tampering by Potentially Suspicious Processes

Rule

Title

Registry Tampering by Potentially Suspicious Processes

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-08-13

Modified

2026-04-14

File

rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

Log source

product

windows

category

registry_event

Detection

selection:
    Image|endswith:
        # Add more suspicious processes
        - '\mshta.exe'
        - '\wscript.exe'
        - '\cscript.exe'
filter_main_binary_data:
    Details: 'Binary Data'
filter_main_null:
    Details: null
filter_main_wscript_legit_1:
    Image|endswith: '\wscript.exe'
    TargetObject|contains:
        - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
        - '\Services\bam\State\UserSettings\S-1-'
        - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
        - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
filter_main_wscript_legit_2:
    Image|endswith: '\wscript.exe'
    TargetObject|contains: '\wscript.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Some legitimate admin or install scripts may use these processes for registry modifications.

Tags

• attack.persistence
• attack.execution
• attack.defense-impairment
• attack.t1112
• attack.t1059.005

MITRE ATT&CK ids this rule names

• T1059.005
• T1112

Related rules

• 2a0a169d-cc66-43ce-9ae2-6e678e54e46a (similar)
• 921aa10f-2e74-4cca-9498-98f9ca4d6fdf (similar)

References

• https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
• https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml