Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

title: "Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys"
id: 276f9794-add1-413b-9292-ff1020bc167d
status: test
description: This rule identifies registry entries under Windows Run-related paths that contain VBScript and related script/HTMLApplication execution indicators. Attackers may store script payloads in registry to achieve persistence or launch execution via built-in auto-run mechanisms. Telemetry required includes registry set events with TargetObject and Details fields that capture embedded script content and related COM/HTML execution patterns.
references:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: Software\Microsoft\Windows\CurrentVersion
    Details|contains:
      - "vbscript:"
      - "jscript:"
      - mshtml,
      - RunHTMLApplication
      - Execute(
      - CreateObject
      - window.close
  filter:
    TargetObject|contains: Software\Microsoft\Windows\CurrentVersion\Run
  filter_dotnet:
    Image|endswith: \msiexec.exe
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\
    Details|contains:
      - \Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll
      - <\Microsoft.mshtml,fileVersion=
      - _mshtml_dll_
      - <\Microsoft.mshtml,culture=
  condition: selection and not 1 of filter*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 46490193-1b22-4c29-bdd6-5bf63907216f
    type: derived