Suspicious Registry Change Attempt Through VBScript (via process_creation)

title: Suspicious Registry Change Attempt Through VBScript (via process_creation)
id: 23e68a53-5ee7-5c10-98f7-da9af1940bf7
status: stable
description: This rule detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this method to evade detection by security solutions that monitor for direct registry modifications through traditional tools.
references:
    - https://attack.mitre.org/techniques/T1059/005/
    - https://attack.mitre.org/techniques/T1112/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
date: 2026-02-01
author: Huntrule Team
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'CreateObject'
            - 'Wscript.shell'
            - '.RegWrite'
    condition: selection
falsepositives:
    - Unknown
level: medium