Windows: REGISTER_APP.VBS VSS/VDS COM+ Provider Registration via -register

Alerts when REGISTER_APP.VBS is executed with -register to register a VSS/VDS provider as a COM+ application.

FreeUnreviewedSigmamediumv1

windows-register-app-vbs-vss-vds-com-provider-registration-via-register-1c8774a0

title: "Windows: REGISTER_APP.VBS VSS/VDS COM+ Provider Registration via -register"
id: 5f2b2b73-715f-40ca-ab0d-f518c5382b2a
status: test
description: This rule flags process command lines that include the Microsoft signed script REGISTER_APP.VBS being invoked with the -register parameter. It indicates an attempt to register a VSS/VDS provider as a COM+ application, which can be used for stealthy persistence or to influence system components. The detection relies on Windows process creation telemetry and matching the presence of the specific script path fragment and -register in the command line.
references:
  - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_register_app.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \register_app.vbs
      - -register
  condition: selection
falsepositives:
  - Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign
level: medium
license: DRL-1.1
related:
  - id: 1c8774a0-44d4-4db0-91f8-e792359c70bd
    type: derived

What it detects

This rule flags process command lines that include the Microsoft signed script REGISTER_APP.VBS being invoked with the -register parameter. It indicates an attempt to register a VSS/VDS provider as a COM+ application, which can be used for stealthy persistence or to influence system components. The detection relies on Windows process creation telemetry and matching the presence of the specific script path fragment and -register in the command line.

Known false positives

Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.