Suspicious VBScript Execution Pattern (UNC2452)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.