SafeBoot Registry Key Deleted Via Reg.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
Source: github.com/SigmaHQ/sigma

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: SafeBoot Registry Key Deleted Via Reg.EXE
id: fc0e89b5-adb0-43c1-b749-c12a10ec37de
related:
    - id: d7662ff6-9e97-4596-a61d-9839e32dee8d
      type: similar
status: test
description: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products
references:
    - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
date: 2022-08-08
modified: 2023-02-04
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: 'reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_delete:
        CommandLine|contains|all:
            - ' delete '
            - '\SYSTEM\CurrentControlSet\Control\SafeBoot'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: 'reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_delete`

selection_delete:
    CommandLine|contains|all:
        - ' delete '
        - '\SYSTEM\CurrentControlSet\Control\SafeBoot'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`delete` corpus 5 (sigma 4, splunk 1) `\SYSTEM\CurrentControlSet\Control\SafeBoot` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`reg.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"reg.exe"`
`OriginalFileName`	eq	`reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq value:"reg.exe"`