PowerShell VBScript Registry Modification Attempt via Wscript.shell RegWrite

Identifies PowerShell commands embedding VBScript Wscript.shell .RegWrite to modify Windows registry values.

FreeUnreviewedSigmamediumv1

powershell-vbscript-registry-modification-attempt-via-wscript-shell-regwrite-2a0a169d

title: PowerShell VBScript Registry Modification Attempt via Wscript.shell RegWrite
id: 3580787a-d668-491f-9459-f6442ac55610
related:
  - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
    type: similar
  - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
    type: similar
  - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
    type: derived
status: experimental
description: This rule flags PowerShell script content that creates a VBScript Shell object (CreateObject("Wscript.shell")) and invokes the .RegWrite method. Attackers can use embedded VBScript within PowerShell to change registry values without relying on reg.exe, regedit.exe, or PowerShell native registry cmdlets. The detection relies on PowerShell ScriptBlock text containing the specific CreateObject and RegWrite usage patterns.
references:
  - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
  - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml
date: 2025-08-13
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - attack.t1059.005
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    ScriptBlockText|contains|all:
      - CreateObject
      - Wscript.shell
      - .RegWrite
  condition: selection
falsepositives:
  - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script content that creates a VBScript Shell object (CreateObject("Wscript.shell")) and invokes the .RegWrite method. Attackers can use embedded VBScript within PowerShell to change registry values without relying on reg.exe, regedit.exe, or PowerShell native registry cmdlets. The detection relies on PowerShell ScriptBlock text containing the specific CreateObject and RegWrite usage patterns.

Known false positives

Some legitimate admin or install scripts may use these processes for registry modifications.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.