huntrule

Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

Flags registry persistence where script payload indicators like vbscript: and RunHTMLApplication appear in set registry values.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-03-05
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies registry entries under Windows Run-related paths that contain VBScript and related script/HTMLApplication execution indicators. Attackers may store script payloads in registry to achieve persistence or launch execution via built-in auto-run mechanisms. Telemetry required includes registry set events with TargetObject and Details fields that capture embedded script content and related COM/HTML execution patterns.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Malicious Run Key Persistence Referencing DLL in User Documents
PlugX Persistence via Run Key Named AAM Updatevlm
Suspicious Autorun Registry Persistence via sausageLoop Run Key
Malicious BabyLockerKZ Run Key Persistence
Suspicious Run Key Persistence Pointing To User-Writable Path
Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)
Persistence Run Key Pointing to svchost.exe in AppData Roaming
URL Shortcut File Created in Startup Folder for Persistence
Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos
Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.