Registry Modification Attempt Via VBScript

Title: Registry Modification Attempt Via VBScript
Status: experimental
Description:Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.
References:
  -https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
  -https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
modified:None
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1112'
• -'attack.t1059.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'CreateObject'
      -'Wscript.shell'
      -'.RegWrite'

  condition:selection
Falsepositives:
  -Unknown
Level: medium