Attempted VBScript Stored in Non-Run CurrentVersion Registry Key Value

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identify potential new registry key name that is a non-autorun and non-run key in the HKLM\Software\Microsoft\Windows\CurrentVersion\ registry key containing VBScript in the key value value.

Attribute	Value
Type	Hunting Query
Solution	Cyborg Security HUNTER
ID	d7233f14-4705-403e-9db9-e0d677c9506b
Tactics	DefenseEvasion
Techniques	T1112
Required Connectors	SecurityEvent
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SecurityEvent	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Cyborg Security HUNTER