PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

title: PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging
id: ff1fa452-810b-424c-93e9-336b9ebe8118
related:
  - id: 970007b7-ce32-49d0-a4a4-fbef016950bd
    type: similar
  - id: 064060aa-09fb-4636-817f-020a32aa7e9e
    type: derived
status: test
description: This rule flags PowerShell script block content that references Windows registry paths commonly associated with service configuration and auto-start/run locations. Attackers often query these locations to discover how the system is configured and what software or persistence mechanisms may be present. It relies on Script Block Logging telemetry from Windows PowerShell to inspect the script text for registry path patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml
author: frack113, Huntrule Team
date: 2023-07-02
tags:
  - attack.discovery
  - attack.t1012
  - attack.t1007
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|re: (Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\(currentcontrolset\\services|CurrentVersion\\Policies\\Explorer\\Run|CurrentVersion\\Run|CurrentVersion\\ShellServiceObjectDelayLoad|CurrentVersion\\Windows\winlogon)\\
  condition: selection
falsepositives:
  - Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.
level: medium
license: DRL-1.1