Suspicious PowerShell Usage in Registry Run Keys

Persistence via Windows Registry Run keys is a common technique used by various malware families, including those associated with Malware-as-a-Service (MaaS) operations like SystemBC, to maintain access across reboots. Threat actors modify specific registry hives (Run, RunOnce, or Policy/Explorer/Run) to inject malicious PowerShell commands that execute in the background. By utilizing common PowerShell parameters like -w hidden, -nop, and ExecutionPolicy Bypass, attackers attempt to minimize user visibility and security tool interference. This technique effectively bypasses traditional startup folder monitoring and remains a persistent threat for organizations failing to audit registry modifications involving script execution. Defenders must monitor registry set events to identify unauthorized additions to these keys that invoke command-line interpreters.

Attack Chain

1. Initial access is established through phishing, exploit, or credential compromise.
2. The attacker executes a staging command to set a persistent entry in the registry.
3. The attacker modifies HKLM or HKCU Run keys to include a malicious PowerShell one-liner.
4. The command utilizes obfuscation, such as Base64 encoding or hidden window styles.
5. On system reboot or user login, the Windows Registry Run key triggers the execution of powershell.exe.
6. The PowerShell process executes the payload, which may involve downloading additional stages via Invoke-WebRequest or Invoke-Expression.
7. The final payload achieves C2 connectivity or initiates ransomware/exfiltration activity.

Impact

Successful persistence allows attackers to maintain long-term access to compromised hosts, facilitating ongoing data exfiltration, ransomware deployment, or lateral movement. Unchecked registry modifications can lead to system-wide compromises where legitimate administrative persistence mechanisms are subverted to run malicious code automatically on every boot.

Recommendation

1. Deploy the Sigma rule below to detect suspicious modifications to Run keys that incorporate PowerShell execution artifacts.
2. Establish a baseline for legitimate administrative scripts that modify registry Run keys to reduce false positives.
3. Enable Sysmon or Windows Audit Policy for Registry modifications (Event ID 12, 13, 14) to capture the necessary telemetry.
4. Use the provided Atomic Red Team test cases (e.g., T1547.001) to validate the efficacy of existing detection coverage for registry persistence.