Suspicious PowerShell in Registry Run Keys for Persistence
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
Sigma
