VBScript Payload Stored in Registry
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "Software\Microsoft\Windows\CurrentVersion" OR (OBJECTNAME endswith "Software\Microsoft\Windows" AND OBJECTVALUENAME startswith "CurrentVersion")) AND INFORMATION contains "vbscript:,jscript:,mshtml,,RunHTMLApplication,Execute(,CreateObject,window.close") AND ((OBJECTNAME notcontains "Software\Microsoft\Windows\CurrentVersion\Run" AND (OBJECTNAME notendswith "Software\Microsoft\Windows\CurrentVersion" OR OBJECTVALUENAME notstartswith "Run")) AND (PROCESSNAME notendswith "\msiexec.exe" OR (OBJECTNAME notcontains "\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData" AND (OBJECTNAME notendswith "\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData" OR isNotExist(OBJECTVALUENAME))) OR INFORMATION notcontains "\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll,<\Microsoft.mshtml,fileVersion=,_mshtml_dll_,<\Microsoft.mshtml,culture=")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
