sigmahighHunting

Reg Add Suspicious Paths

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

MITRE ATT&CK

persistencedefense-evasion

Detection Query

selection_reg:
  - Image|endswith: \reg.exe
  - OriginalFileName: reg.exe
selection_path:
  CommandLine|contains:
    - \AppDataLow\Software\Microsoft\
    - \Policies\Microsoft\Windows\OOBE
    - \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon
    - \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon
    - \CurrentControlSet\Control\SecurityProviders\WDigest
    - \Microsoft\Windows Defender\
condition: all of selection_*

Author

frack113, Nasreddine Bencherchali (Nextron Systems)

Created

2022-08-19

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.persistenceattack.defense-evasionattack.t1112attack.t1562.001

Raw Content

title: Reg Add Suspicious Paths
id: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829
status: test
description: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
modified: 2022-10-10
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1112
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_path:
        CommandLine|contains:
            # Add more suspicious registry locations below
            - '\AppDataLow\Software\Microsoft\'
            - '\Policies\Microsoft\Windows\OOBE'
            - '\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon'
            - '\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon'
            - '\CurrentControlSet\Control\SecurityProviders\WDigest'
            - '\Microsoft\Windows Defender\'
    condition: all of selection_*
falsepositives:
    - Rare legitimate add to registry via cli (to these locations)
level: high