Registry Manipulation by Potentially Suspicious Processes (via registry_event)

title: Registry Manipulation by Potentially Suspicious Processes (via registry_event)
id: de061af2-e06c-54ba-a2e6-b1872834d23c
status: stable
description: This rule detects anomalous registry modifications made by anomalous processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their behavior may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
    - https://attack.mitre.org/techniques/T1059/005/
    - https://attack.mitre.org/techniques/T1112/
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Huntrule Team
date: 2026-05-16
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_main_binary_data:
        Details: 'Binary Data'
    filter_main_null:
        Details:
    filter_main_wscript_legit_1:
        Image|endswith: '\wscript.exe'
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
            - '\Services\bam\State\UserSettings\S-1-'
            - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
            - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
    filter_main_wscript_legit_2:
        Image|endswith: '\wscript.exe'
        TargetObject|contains: '\wscript.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium