huntrule

PowerShell Service Persistence via Registry ImagePath on Windows

Flags Windows registry service ImagePath entries that reference PowerShell (powershell/pwsh).

FreeUnreviewedSigmahighv1
title: PowerShell Service Persistence via Registry ImagePath on Windows
id: 801fa81a-3558-4305-94da-60cf8bcf97a3
status: test
description: This rule identifies attempts to persist PowerShell by writing a registry service entry where the service ImagePath contains powershell or pwsh. Attackers may use this technique to launch PowerShell automatically via the Windows Service mechanism. It relies on Windows registry set telemetry capturing the TargetObject path under \Services\ and the ImagePath content in Details.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_as_service.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2023-08-17
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\
    TargetObject|endswith: \ImagePath
    Details|contains:
      - powershell
      - pwsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d
    type: derived

What it detects

This rule identifies attempts to persist PowerShell by writing a registry service entry where the service ImagePath contains powershell or pwsh. Attackers may use this technique to launch PowerShell automatically via the Windows Service mechanism. It relies on Windows registry set telemetry capturing the TargetObject path under \Services\ and the ImagePath content in Details.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.