Suspicious PowerShell In Registry Run Keys
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects potential PowerShell commands or code within registry run keys
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME contains "\Software\Microsoft\Windows\CurrentVersion\Run,\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run,\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" OR ((OBJECTNAME endswith "\Software\Microsoft\Windows\CurrentVersion" AND OBJECTVALUENAME startswith "Run") OR (OBJECTNAME endswith "\Software\WOW6432Node\Microsoft\Windows\CurrentVersion" AND OBJECTVALUENAME startswith "Run") OR (OBJECTNAME endswith "\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" AND OBJECTVALUENAME startswith "Run"))) AND INFORMATION contains "powershell,pwsh ,FromBase64String,.DownloadFile(,.DownloadString(, -w hidden , -w 1 ,-windowstyle hidden,-window hidden, -nop , -encodedcommand ,-ExecutionPolicy Bypass,Invoke-Expression,IEX (,Invoke-Command,ICM -,Invoke-WebRequest,IWR ,Invoke-RestMethod,IRM , -noni , -noninteractive " select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113, Florian Roth (Nextron Systems)
