Query: rule covering Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded wit
Matching passage: Sigma rule: Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded wit. Logsource: windows / ps_script. Rule: title: Registry Modification Attempt Via VBScript - PowerShell id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a related: - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf type: similar - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 type: similar status: experimental description: 'Detects attempts to modify the registry using VBScript''s CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell''s native registry cmdlets. ' references: - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad date: 2025-08-13 author: Swachchhanda Shrawan Poudel (Nextron Systems) tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - CreateObject - Wscript.shell - .RegWrite condition: selection falsepositives: - Some legitimate admin or install scripts may use these processes for registry modifications. level: medium
Near-miss passage: Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / registry_set. Rule: title: RestrictedAdminMode Registry Value Tampering id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 related: - id: 28ac00d6-22d9-4a3c-927f-bbd770104573 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx author: frack113 date: 2023-01-13 modified: 2024-08-23 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high