huntrule

VBScript Registry Write Attempt via Wscript.shell RegWrite on Windows

Flags command lines containing Wscript.shell CreateObject and RegWrite, indicating VBScript-driven registry modification attempts.

FreeUnreviewedSigmamediumv1
title: VBScript Registry Write Attempt via Wscript.shell RegWrite on Windows
id: 9a0e8b49-a7d3-40ec-aed1-78a8476e9ccd
related:
  - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
    type: similar
  - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
    type: similar
  - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
    type: derived
status: experimental
description: This rule flags Windows process executions whose command line includes the VBScript automation pattern CreateObject("Wscript.shell") and the RegWrite method call. Such activity can indicate an attempt to programmatically modify registry values without using common registry management utilities. It matters because attackers may use script-based registry writes for persistence or other configuration changes while blending in with legitimate scripting behavior. Telemetry relied on is Windows process creation events and the executed command line content.
references:
  - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
  - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml
date: 2025-08-13
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - CreateObject
      - Wscript.shell
      - .RegWrite
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process executions whose command line includes the VBScript automation pattern CreateObject("Wscript.shell") and the RegWrite method call. Such activity can indicate an attempt to programmatically modify registry values without using common registry management utilities. It matters because attackers may use script-based registry writes for persistence or other configuration changes while blending in with legitimate scripting behavior. Telemetry relied on is Windows process creation events and the executed command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.