{"id":"1547e27c-3974-43e2-a7d7-7f484fb928ec","title":"Registry Persistence via Service in Safe Mode","description":"Detects the modification of the registry to allow a driver or service to persist in Safe Mode.","author":"frack113","status":"test","level":"high","date":"2022-04-04","modified":"2025-10-22","tags":["attack.stealth","attack.t1564.001"],"technique_ids":["T1564.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network"],"source_path":"rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml","source_sha256":"78fab7714a33591ac3022107b7a2c0546214454067bd3bd6e6b4cf67303a8f57","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Registry Persistence via Service in Safe Mode\nid: 1547e27c-3974-43e2-a7d7-7f484fb928ec\nstatus: test\ndescription: Detects the modification of the registry to allow a driver or service to persist in Safe Mode.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network\nauthor: frack113\ndate: 2022-04-04\nmodified: 2025-10-22\ntags:\n    - attack.stealth\n    - attack.t1564.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains:\n            - '\\Control\\SafeBoot\\Minimal\\'\n            - '\\Control\\SafeBoot\\Network\\'\n        TargetObject|endswith: '\\(Default)'\n        Details: 'Service'\n    filter_optional_sophos:\n        Image: 'C:\\WINDOWS\\system32\\msiexec.exe'\n        TargetObject|endswith:\n            - '\\Control\\SafeBoot\\Minimal\\SAVService\\(Default)'\n            - '\\Control\\SafeBoot\\Network\\SAVService\\(Default)'\n    filter_optional_mbamservice:\n        Image|endswith: '\\MBAMInstallerService.exe'\n        TargetObject|endswith: '\\MBAMService\\(Default)'\n        Details: 'Service'\n    filter_optional_hexnode:\n        Image: 'C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe'\n        TargetObject|endswith:\n            - '\\Control\\SafeBoot\\Minimal\\Hexnode Updater\\(Default)'\n            - '\\Control\\SafeBoot\\Network\\Hexnode Updater\\(Default)'\n            - '\\Control\\SafeBoot\\Minimal\\Hexnode Agent\\(Default)'\n            - '\\Control\\SafeBoot\\Network\\Hexnode Agent\\(Default)'\n        Details: 'Service'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Windows Add Registry Value to Load Service in Safe Mode without Network\n      technique: T1112\n      atomic_guid: 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5\n    - type: atomic-red-team\n      name: Windows Add Registry Value to Load Service in Safe Mode with Network\n      technique: T1112\n      atomic_guid: c173c948-65e5-499c-afbe-433722ed5bd4\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.001","id":"T1564.001","name":"Hidden Files and Directories","page":"techniques/enterprise/T1564.001/"}],"data_path":"data/detection-rules/1547e27c-3974-43e2-a7d7-7f484fb928ec.json","kind":"sigma"}