
title: VBScript Payload Stored in Registry
author: Florian Roth
date: 2021/03/05
description: Detects VBScript content stored into registry keys as seen being used
  by UNC2452 group
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*Software\Microsoft\Windows\CurrentVersion*'
  SELECTION_5:
    Details:
    - '*vbscript*'
    - '*jscript*'
    - '*mshtml*'
    - '*mshtml,*'
    - '*mshtml *'
    - '*RunHTMLApplication*'
    - '*Execute(*'
    - '*CreateObject*'
    - '*RegRead*'
    - '*window.close*'
  SELECTION_6:
    TargetObject: '*Software\Microsoft\Windows\CurrentVersion\Run*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and (SELECTION_4 and SELECTION_5)
    and  not (SELECTION_6))
falsepositives:
- Unknown
id: 46490193-1b22-4c29-bdd6-5bf63907216f
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
status: experimental
tags:
- attack.persistence
- attack.t1547.001
ruletype: SIGMA
