Detection rules › Sigma
Service Registry Key Deleted Via Reg.EXE
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
Known false positives
- Unlikely
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Service Registry Key Deleted Via Reg.EXE
id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5
status: test
description: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
references:
- https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-01
modified: 2023-02-04
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: 'reg.exe'
- OriginalFileName: 'reg.exe'
selection_delete:
CommandLine|contains: ' delete '
selection_key:
# Add specific services if you would like the rule to be more specific
CommandLine|contains: '\SYSTEM\CurrentControlSet\services\'
condition: all of selection_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: 'reg.exe'
- OriginalFileName: 'reg.exe'
Stage 2: selection_delete
selection_delete:
CommandLine|contains: ' delete '
Stage 3: selection_key
selection_key:
CommandLine|contains: '\SYSTEM\CurrentControlSet\services\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"reg.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"reg.exe" |