Suspicious PowerShell In Registry Run Keys

Title: Suspicious PowerShell In Registry Run Keys
Status: test
Description:Detects potential PowerShell commands or code within registry run keys
References:
  -https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry
  -https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
  -https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-03-17
modified:2025-07-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.001'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains:
      -'\Software\Microsoft\Windows\CurrentVersion\Run'
      -'\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
      -'\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'

    Details|contains:
      -'powershell'
      -'pwsh '
      -'FromBase64String'
      -'.DownloadFile('
      -'.DownloadString('
      -' -w hidden '
      -' -w 1 '
      -'-windowstyle hidden'
      -'-window hidden'
      -' -nop '
      -' -encodedcommand '
      -'-ExecutionPolicy Bypass'
      -'Invoke-Expression'
      -'IEX ('
      -'Invoke-Command'
      -'ICM -'
      -'Invoke-WebRequest'
      -'IWR '
      -'Invoke-RestMethod'
      -'IRM '
      -' -noni '
      -' -noninteractive '

  condition:selection
Falsepositives:
  -Legitimate admin or third party scripts. Baseline according to your environment
Level: medium