VBScript Payload Stored in Registry for Persistence in Registry
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
Sigma
