Detection rules › Sigma
Registry Tampering by Potentially Suspicious Processes
Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.005 Command and Scripting Interpreter: Visual Basic |
| Persistence | T1112 Modify Registry |
| Defense Impairment | T1112 Modify Registry |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
Rule body yaml
title: Registry Tampering by Potentially Suspicious Processes
id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
related:
- id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
type: similar
- id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
type: similar
status: experimental
description: |
Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-13
modified: 2026-04-14
tags:
- attack.persistence
- attack.execution
- attack.defense-impairment
- attack.t1112
- attack.t1059.005
logsource:
category: registry_event
product: windows
detection:
selection:
Image|endswith:
# Add more suspicious processes
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
filter_main_binary_data:
Details: 'Binary Data'
filter_main_null:
Details: null
filter_main_wscript_legit_1:
Image|endswith: '\wscript.exe'
TargetObject|contains:
- 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
- '\Services\bam\State\UserSettings\S-1-'
- 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
- 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
filter_main_wscript_legit_2:
Image|endswith: '\wscript.exe'
TargetObject|contains: '\wscript.exe'
condition: selection and not 1 of filter_main_*
falsepositives:
- Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
Image|endswith:
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
Stage 2: not filter_main_*
filter_main_binary_data:
Details: 'Binary Data'
filter_main_null:
Details: null
filter_main_wscript_legit_1:
Image|endswith: '\wscript.exe'
TargetObject|contains:
- 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
- '\Services\bam\State\UserSettings\S-1-'
- 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
- 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
filter_main_wscript_legit_2:
Image|endswith: '\wscript.exe'
TargetObject|contains: '\wscript.exe'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TargetObject | match | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\ |
TargetObject | match | Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\ |
TargetObject | match | Software\Microsoft\Windows\CurrentVersion\Internet Settings\ |
TargetObject | match | \Services\bam\State\UserSettings\S-1- |
Image | ends_with | \wscript.exe |
Image | ends_with | \wscript.exe |
TargetObject | match | \wscript.exe |
Details | eq | Binary Data |
Details | is_null |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|