PowerShell Registry Reconnaissance via Script Block Queries (Windows)

Identifies PowerShell script blocks querying sensitive registry keys tied to services and Run/Explorer/winlogon locations.

FreeUnreviewedSigmamediumv1

powershell-registry-reconnaissance-via-script-block-queries-windows-064060aa

title: PowerShell Registry Reconnaissance via Script Block Queries (Windows)
id: ff1fa452-810b-424c-93e9-336b9ebe8118
related:
  - id: 970007b7-ce32-49d0-a4a4-fbef016950bd
    type: similar
  - id: 064060aa-09fb-4636-817f-020a32aa7e9e
    type: derived
status: test
description: This rule flags PowerShell script block content that queries specific Windows registry paths related to service configuration and Run/Explorer/winlogon execution points. Attackers use registry interrogation to discover system state and potential persistence or execution-related settings before or during compromise. Detection relies on script block logging telemetry capturing the matching PowerShell cmdlet and target registry path patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml
author: frack113, Huntrule Team
date: 2023-07-02
tags:
  - attack.discovery
  - attack.t1012
  - attack.t1007
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|re: (Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\(currentcontrolset\\services|CurrentVersion\\Policies\\Explorer\\Run|CurrentVersion\\Run|CurrentVersion\\ShellServiceObjectDelayLoad|CurrentVersion\\Windows\winlogon)\\
  condition: selection
falsepositives:
  - Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block content that queries specific Windows registry paths related to service configuration and Run/Explorer/winlogon execution points. Attackers use registry interrogation to discover system state and potential persistence or execution-related settings before or during compromise. Detection relies on script block logging telemetry capturing the matching PowerShell cmdlet and target registry path patterns.

Known false positives

Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.