Detection rules › Sigma

Registry Tampering by Potentially Suspicious Processes

Status
experimental
Severity
medium
Log source
product windows, category registry_event
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Registry Tampering by Potentially Suspicious Processes
id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
related:
    - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
      type: similar
    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
      type: similar
status: experimental
description: |
    Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
    These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
    without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-13
modified: 2026-04-14
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        Image|endswith:
            # Add more suspicious processes
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_main_binary_data:
        Details: 'Binary Data'
    filter_main_null:
        Details: null
    filter_main_wscript_legit_1:
        Image|endswith: '\wscript.exe'
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
            - '\Services\bam\State\UserSettings\S-1-'
            - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
            - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
    filter_main_wscript_legit_2:
        Image|endswith: '\wscript.exe'
        TargetObject|contains: '\wscript.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    Image|endswith:
        - '\mshta.exe'
        - '\wscript.exe'
        - '\cscript.exe'

Stage 2: not filter_main_*

filter_main_binary_data:
    Details: 'Binary Data'
filter_main_null:
    Details: null
filter_main_wscript_legit_1:
    Image|endswith: '\wscript.exe'
    TargetObject|contains:
        - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
        - '\Services\bam\State\UserSettings\S-1-'
        - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
        - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
filter_main_wscript_legit_2:
    Image|endswith: '\wscript.exe'
    TargetObject|contains: '\wscript.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
TargetObjectmatchSOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\
TargetObjectmatchSoftware\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\
TargetObjectmatchSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\
TargetObjectmatch\Services\bam\State\UserSettings\S-1-
Imageends_with\wscript.exe
Imageends_with\wscript.exe
TargetObjectmatch\wscript.exe
DetailseqBinary Data
Detailsis_null(no value, null check)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \cscript.exe corpus 73 (sigma 73)
  • \mshta.exe corpus 67 (sigma 67)
  • \wscript.exe corpus 75 (sigma 75)