Registry Modification Attempt Via VBScript - PowerShell

Title: Registry Modification Attempt Via VBScript - PowerShell
Status: experimental
Description:Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
References:
  -https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
  -https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  -https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
modified:None
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1112'
• -'attack.t1059.005'

Logsource:

• category: ps_script
• product: windows

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'CreateObject'
      -'Wscript.shell'
      -'.RegWrite'

  condition:selection
Falsepositives:
  -Some legitimate admin or install scripts may use these processes for registry modifications.
Level: medium