detection.wiki

Detection rules › Sigma

Suspicious PowerShell In Registry Run Keys

Severity
medium
Author
frack113, Florian Roth (Nextron Systems)
Source
upstream

Detects potential PowerShell commands or code within registry run keys

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege EscalationT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection

or:
Details|contains: ' -encodedcommand '
Details|contains: ' -noni '
Details|contains: ' -noninteractive '
Details|contains: ' -nop '
Details|contains: ' -w 1 '
Details|contains: ' -w hidden '
Details|contains: '-ExecutionPolicy Bypass'
Details|contains: '-window hidden'
Details|contains: '-windowstyle hidden'
Details|contains: '.DownloadFile('
Details|contains: '.DownloadString('
Details|contains: FromBase64String
Details|contains: 'ICM -'
Details|contains: 'IEX ('
Details|contains: 'IRM '
Details|contains: 'IWR '
Details|contains: Invoke-Command
Details|contains: Invoke-Expression
Details|contains: Invoke-RestMethod
Details|contains: Invoke-WebRequest
Details|contains: powershell
Details|contains: 'pwsh '
or:
TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run'
TargetObject|contains: '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • -encodedcommand
  • -noni
  • -noninteractive
  • -nop
  • -w 1
  • -w hidden
  • -ExecutionPolicy Bypass
  • -window hidden
  • -windowstyle hidden
  • .DownloadFile(
  • .DownloadString(
  • FromBase64String
  • ICM -
  • IEX (
  • IRM
  • IWR
  • Invoke-Command
  • Invoke-Expression
  • Invoke-RestMethod
  • Invoke-WebRequest
  • powershell corpus 8 (sigma 8)
  • pwsh
TargetObjectmatch
  • \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run corpus 3 (sigma 3)
  • \Software\Microsoft\Windows\CurrentVersion\Run corpus 3 (sigma 3)
  • \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run corpus 3 (sigma 3)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.