detection.wiki

Detection rules › Sigma

Reg Add Suspicious Paths

Status
test
Severity
high
Log source
product windows, category process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry, T1685 Disable or Modify Tools

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Reg Add Suspicious Paths
id: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829
status: test
description: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
modified: 2022-10-10
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_path:
        CommandLine|contains:
            # Add more suspicious registry locations below
            - '\AppDataLow\Software\Microsoft\'
            - '\Policies\Microsoft\Windows\OOBE'
            - '\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon'
            - '\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon'
            - '\CurrentControlSet\Control\SecurityProviders\WDigest'
            - '\Microsoft\Windows Defender\'
    condition: all of selection_*
falsepositives:
    - Rare legitimate add to registry via cli (to these locations)
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_reg

selection_reg:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: selection_path

selection_path:
    CommandLine|contains:
        - '\AppDataLow\Software\Microsoft\'
        - '\Policies\Microsoft\Windows\OOBE'
        - '\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon'
        - '\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon'
        - '\CurrentControlSet\Control\SecurityProviders\WDigest'
        - '\Microsoft\Windows Defender\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \AppDataLow\Software\Microsoft\
  • \CurrentControlSet\Control\SecurityProviders\WDigest
  • \Microsoft\Windows Defender\
  • \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon
  • \Policies\Microsoft\Windows\OOBE
  • \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon
Imageends_with
  • \reg.exe corpus 58 (sigma 58)
OriginalFileNameeq
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)