Registry Tampering by Potentially Suspicious Processes

Title: Registry Tampering by Potentially Suspicious Processes
Status: experimental
Description:Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
References:
  -https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  -https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
modified:2026-04-14
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1112'
• -'attack.t1059.005'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\mshta.exe'
      -'\wscript.exe'
      -'\cscript.exe'

  filter_main_binary_data:
    Details: 'Binary Data'
  filter_main_null:
    Details: 'None'
  filter_main_wscript_legit_1:
    Image|endswith: '\wscript.exe'
    TargetObject|contains:
      -'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
      -'\Services\bam\State\UserSettings\S-1-'
      -'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
      -'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'

  filter_main_wscript_legit_2:
    Image|endswith: '\wscript.exe'
    TargetObject|contains: '\wscript.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Some legitimate admin or install scripts may use these processes for registry modifications.
Level: medium