Registry Tampering by Potentially Suspicious Processes

Hunt Hypothesis

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifica

Detection Rule

Sigma (Original)

title: Registry Tampering by Potentially Suspicious Processes
id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
related:
    - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
      type: similar
    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
      type: similar
status: experimental
description: |
    Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
    These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
    without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-13
modified: 2026-04-14
tags:
    - attack.defense-evasion
    - attack.persistence
    - attack.execution
    - attack.t1112
    - attack.t1059.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        Image|endswith:
            # Add more suspicious processes
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_main_legit_wscript:
        Image|endswith: '\wscript.exe'
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
            - '\Services\bam\State\UserSettings\S-1-'
            - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
            - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium

KQL (Azure Sentinel)

imRegistry
| where (ActingProcessName endswith "\\mshta.exe" or ActingProcessName endswith "\\wscript.exe" or ActingProcessName endswith "\\cscript.exe") and (not((ActingProcessName endswith "\\wscript.exe" and (RegistryKey endswith "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data*" or RegistryKey contains "\\Services\\bam\\State\\UserSettings\\S-1-" or RegistryKey endswith "Software\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe*" or RegistryKey endswith "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings*"))))

Required Data Sources

False Positive Guidance

• **Scenario

MITRE ATT&CK Context

• Tactic: Defense Evasion
• Tactic: Persistence
• Tactic: Execution
• Technique: T1112 — T1112
• Technique: T1059.005 — T1059.005

References

• https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
• https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
• SigmaHQ Rule