Detectionmediumtest

Suspicious PowerShell In Registry Run Keys

Detects potential PowerShell commands or code within registry run keys

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François Hubaut, Florian Roth (Nextron Systems)Created Thu Mar 17Updated Fri Jul 188d85cf08-bf97-4260-ba49-986a2a65129cwindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run' # Also covers "RunOnce" and "RunOnceEx"
            - '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
        Details|contains:
            - 'powershell'
            - 'pwsh '
            - 'FromBase64String'
            - '.DownloadFile('
            - '.DownloadString('
            - ' -w hidden '
            - ' -w 1 '
            - '-windowstyle hidden'
            - '-window hidden'
            - ' -nop '
            - ' -encodedcommand '
            - '-ExecutionPolicy Bypass'
            - 'Invoke-Expression'
            - 'IEX ('
            - 'Invoke-Command'
            - 'ICM -'
            - 'Invoke-WebRequest'
            - 'IWR '
            - 'Invoke-RestMethod'
            - 'IRM '
            - ' -noni '
            - ' -noninteractive '
    condition: selection