Suspicious Hex-Encoded Values in Registry Keys

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious registry modifications where LOLBins (Living Off The Land Binaries) write long hexadecimal-encoded strings to user-writable registry keys. This pattern is commonly observed in fileless malware attacks where threat actors store encoded payloads (shellcode, scripts, or commands) in the registry to evade detection and maintain persistence. The rule specifically monitors PowerShell, reg.exe, script engines, and other commonly abused Windows binaries that adversaries leverage for registry manipulation.

2025-08-13 00:00:00

None

5a5cb696-1b2f-4e3f-a99c-cdaa99e5ce88

attack.defense-evasion attack.t1112 attack.t1027

Nextron Sigma feed only (private)