Registry Modification Attempt Via VBScript - PowerShell

Status: experimental
Severity: medium
Log source: category ps_script, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.

Known false positives

Some legitimate admin or install scripts may use these processes for registry modifications.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.005` Command and Scripting Interpreter: Visual Basic
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Registry Modification Attempt Via VBScript - PowerShell
id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
related:
    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
      type: similar
    - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
      type: similar
status: experimental
description: |
    Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands.
    Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
    This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
references:
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
date: 2025-08-13
author: Swachchhanda Shrawan Poudel (Nextron Systems)
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: ps_script
    product: windows
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'CreateObject'
            - 'Wscript.shell'
            - '.RegWrite'
    condition: selection
falsepositives:
    - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - 'CreateObject'
        - 'Wscript.shell'
        - '.RegWrite'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`.RegWrite` `CreateObject` `Wscript.shell`	`field:"ScriptBlockText" kind:match`