PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging
Identifies PowerShell script blocks querying sensitive registry keys tied to services and Run/Explorer/winlogon locations.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-07-02
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that references Windows registry paths commonly associated with service configuration and auto-start/run locations. Attackers often query these locations to discover how the system is configured and what software or persistence mechanisms may be present. It relies on Script Block Logging telemetry from Windows PowerShell to inspect the script text for registry path patterns.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging
id: ff1fa452-810b-424c-93e9-336b9ebe8118
related:
- id: 970007b7-ce32-49d0-a4a4-fbef016950bd
type: similar
- id: 064060aa-09fb-4636-817f-020a32aa7e9e
type: derived
status: test
description: This rule flags PowerShell script block content that references Windows registry paths commonly associated with service configuration and auto-start/run locations. Attackers often query these locations to discover how the system is configured and what software or persistence mechanisms may be present. It relies on Script Block Logging telemetry from Windows PowerShell to inspect the script text for registry path patterns.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml
author: frack113, Huntrule Team
date: 2023-07-02
tags:
- attack.discovery
- attack.t1012
- attack.t1007
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|re: (Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\(currentcontrolset\\services|CurrentVersion\\Policies\\Explorer\\Run|CurrentVersion\\Run|CurrentVersion\\ShellServiceObjectDelayLoad|CurrentVersion\\Windows\winlogon)\\
condition: selection
falsepositives:
- Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.
level: medium
license: DRL-1.1