Query: rule covering Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript,
Matching passage: Sigma rule: Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript,. Logsource: windows / registry_event. Rule: title: Registry Tampering by Potentially Suspicious Processes id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 related: - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a type: similar - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf type: similar status: experimental description: 'Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence. ' references: - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-08-13 modified: 2026-04-14 tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: registry_event product: windows detection: selection: Image|endswith: - \mshta.exe - \wscript.exe - \cscript.exe filter_main_binary_data: Details: Binary Data filter_main_null: Details: null filter_main_wscript_legit_1: Image|endswith: \wscript.exe TargetObject|contains: - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\ - \Services\bam\State\UserSettings\S-1- - Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\ - Software\Microsoft\Windows\CurrentVersion\Internet Settings\ filter_main_wscript_legit_2: Image|endswith: \wscript.exe TargetObject|contains: \wscript.exe condition: selection and not 1 of filter_main_* falsepositives: - Some legitimate admin or install scripts may use these processes for registry modifications. level: medium
Near-miss passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address. Logsource: windows / security. Rule: title: RDP over Reverse SSH Tunnel WFP id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address references: - https://twitter.com/SBousseaden/status/1096148422984384514 - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx author: Samir Bousseaden date: 2019-02-16 modified: 2022-09-02 tags: - attack.command-and-control - attack.lateral-movement - attack.t1090.001 - attack.t1090.002 - attack.t1021.001 - car.2013-07-002 logsource: product: windows service: security detection: selection: EventID: 5156 sourceRDP: SourcePort: 3389 DestAddress: - 127.* - ::1 destinationRDP: DestPort: 3389 SourceAddress: - 127.* - ::1 filter_app_container: FilterOrigin: AppContainer Loopback filter_thor: Application|endswith: - \thor.exe - \thor64.exe condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter* falsepositives: - Programs that connect locally to the RDP port level: high