Sigma rule: Suspicious PowerShell In Registry Run Keys

Rule

Title

Suspicious PowerShell In Registry Run Keys

Status

test

Level

medium

Author

frack113, Florian Roth (Nextron Systems)

Date

2022-03-17

Modified

2025-07-18

File

rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential PowerShell commands or code within registry run keys

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\Software\Microsoft\Windows\CurrentVersion\Run' # Also covers "RunOnce" and "RunOnceEx"
        - '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
        - '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
    Details|contains:
        - 'powershell'
        - 'pwsh '
        - 'FromBase64String'
        - '.DownloadFile('
        - '.DownloadString('
        - ' -w hidden '
        - ' -w 1 '
        - '-windowstyle hidden'
        - '-window hidden'
        - ' -nop '
        - ' -encodedcommand '
        - '-ExecutionPolicy Bypass'
        - 'Invoke-Expression'
        - 'IEX ('
        - 'Invoke-Command'
        - 'ICM -'
        - 'Invoke-WebRequest'
        - 'IWR '
        - 'Invoke-RestMethod'
        - 'IRM '
        - ' -noni '
        - ' -noninteractive '
condition: selection

False positives (as the rule lists them)

• Legitimate admin or third party scripts. Baseline according to your environment

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

References

• https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry
• https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
• https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml