Suspicious Registry Change Attempt Through VBScript - PowerShell (via ps_script)

title: Suspicious Registry Change Attempt Through VBScript - PowerShell (via ps_script)
id: 7c39e782-cc5f-51ad-8fe5-6a7370afbb2a
status: stable
description: This rule detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors frequently embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This method can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
references:
    - https://attack.mitre.org/techniques/T1059/005/
    - https://attack.mitre.org/techniques/T1112/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
date: 2026-07-14
author: Huntrule Team
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: ps_script
    product: windows
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'CreateObject'
            - 'Wscript.shell'
            - '.RegWrite'
    condition: selection
falsepositives:
    - Unknown
level: medium