Windows Registry Writes for NetWire-Related Keys
Flags newly added Windows registry keys with paths containing \\software\\NetWire, consistent with potential NetWire-related persistence.
- Product
- windows
- Category
- registry_add
- Author
- Christopher Peacock (SigmaHQ), DRL 1.1
- Published
- 2021-10-07
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry additions where the target path contains "\software\NetWire". NetWire malware activity often establishes persistence or configuration under vendor-like subkeys in the Software hive, so matching these paths can surface suspicious installation or follow-on behavior. It relies on Windows registry-add telemetry that provides the TargetObject path for registry_write events.
Reporting behind it
- fortinet.comhttps://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing
- resources.infosecinstitute.comhttps://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line
- app.any.runhttps://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Netwire/registry_add_malware_netwire.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Writes for NetWire-Related Keys
id: bf20860a-593b-46e1-9159-d5792b02a143
status: test
description: This rule flags registry additions where the target path contains "\software\NetWire". NetWire malware activity often establishes persistence or configuration under vendor-like subkeys in the Software hive, so matching these paths can surface suspicious installation or follow-on behavior. It relies on Windows registry-add telemetry that provides the TargetObject path for registry_write events.
references:
- https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing
- https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
- https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
- https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line
- https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Netwire/registry_add_malware_netwire.yml
author: Christopher Peacock, Huntrule Team
date: 2021-10-07
modified: 2025-11-03
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
- detection.emerging-threats
logsource:
product: windows
category: registry_add
detection:
selection:
TargetObject|contains: \software\NetWire
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1d218616-71b0-4c40-855b-9dbe75510f7f
type: derived