{"id":"5e95028c-5229-4214-afae-d653d573d0ec","title":"Security Service Disabled Via Reg.EXE","description":"Detects execution of \"reg.exe\" to disable security services such as Windows Defender.","author":"Florian Roth (Nextron Systems), John Lambert (idea), elhoim","status":"test","level":"high","date":"2021-07-14","modified":"2023-06-05","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://twitter.com/JohnLaTwC/status/1415295021041979392","https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1","https://vms.drweb.fr/virus/?i=24144899","https://bidouillesecurity.com/disable-windows-defender-in-powershell/"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml","source_sha256":"10a94d91eb69d6d7dd0f550676324eccddcb231fb84e5e2b7255148caf511e2f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Security Service Disabled Via Reg.EXE\nid: 5e95028c-5229-4214-afae-d653d573d0ec\nstatus: test\ndescription: Detects execution of \"reg.exe\" to disable security services such as Windows Defender.\nreferences:\n    - https://twitter.com/JohnLaTwC/status/1415295021041979392\n    - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1\n    - https://vms.drweb.fr/virus/?i=24144899\n    - https://bidouillesecurity.com/disable-windows-defender-in-powershell/\nauthor: Florian Roth (Nextron Systems), John Lambert (idea), elhoim\ndate: 2021-07-14\nmodified: 2023-06-05\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_reg_add:\n        CommandLine|contains|all:\n            - 'reg'\n            - 'add'\n    selection_cli_reg_start:\n        CommandLine|contains|all:\n            - 'd 4'\n            - 'v Start'\n        CommandLine|contains:\n            - '\\AppIDSvc'\n            - '\\MsMpSvc'\n            - '\\NisSrv'\n            - '\\SecurityHealthService'\n            - '\\Sense'\n            - '\\UsoSvc'\n            - '\\WdBoot'\n            - '\\WdFilter'\n            - '\\WdNisDrv'\n            - '\\WdNisSvc'\n            - '\\WinDefend'\n            - '\\wscsvc'\n            - '\\wuauserv'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/5e95028c-5229-4214-afae-d653d573d0ec.json","kind":"sigma"}