huntrule

Windows Registry Set Detection of Suspicious Environment Variable Commands

Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.

FreeUnreviewedSigmahighv1
title: Windows Registry Set Detection of Suspicious Environment Variable Commands
id: 78d7dcd5-42db-4326-889c-4b3a5715d681
status: test
description: This rule identifies registry writes that register environment variables containing the \Environment path and suspicious command or encoded string content. Attackers may use environment variables to establish persistence or stealth by injecting PowerShell/Invoke-related commands or base64-encoded payload fragments that execute later. It relies on Windows registry set telemetry, specifically matching TargetObject values and suspicious patterns in the Details field.
references:
  - https://infosec.exchange/@sbousseaden/109542254124022664
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_suspicious_env_variables.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-20
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: windows
  category: registry_set
detection:
  selection_main:
    TargetObject|contains: \Environment\
  selection_details:
    - Details:
        - powershell
        - pwsh
    - Details|contains:
        - \AppData\Local\Temp\
        - C:\Users\Public\
        - TVqQAAMAAAAEAAAA
        - TVpQAAIAAAAEAA8A
        - TVqAAAEAAAAEABAA
        - TVoAAAAAAAAAAAAA
        - TVpTAQEAAAAEAAAA
        - SW52b2tlL
        - ludm9rZS
        - JbnZva2Ut
        - SQBuAHYAbwBrAGUALQ
        - kAbgB2AG8AawBlAC0A
        - JAG4AdgBvAGsAZQAtA
    - Details|startswith:
        - SUVY
        - SQBFAF
        - SQBuAH
        - cwBhA
        - aWV4
        - aQBlA
        - R2V0
        - dmFy
        - dgBhA
        - dXNpbm
        - H4sIA
        - Y21k
        - cABhAH
        - Qzpc
        - Yzpc
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 966315ef-c5e1-4767-ba25-fce9c8de3660
    type: derived

What it detects

This rule identifies registry writes that register environment variables containing the \Environment path and suspicious command or encoded string content. Attackers may use environment variables to establish persistence or stealth by injecting PowerShell/Invoke-related commands or base64-encoded payload fragments that execute later. It relies on Windows registry set telemetry, specifically matching TargetObject values and suspicious patterns in the Details field.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.