{"id":"9b0b7ac3-6223-47aa-a3fd-e8f211e637db","title":"Changing Existing Service ImagePath Value Via Reg.EXE","description":"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":"2024-03-13","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.011"],"technique_ids":["T1574.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml","source_sha256":"1b0e3604d6f0cb7023c5add49df0b581f8b500ac24256157d14ea0850db3a199","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Changing Existing Service ImagePath Value Via Reg.EXE\nid: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db\nstatus: test\ndescription: |\n    Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\n    Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\n    Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe\nauthor: frack113\ndate: 2021-12-30\nmodified: 2024-03-13\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\reg.exe'\n        CommandLine|contains|all:\n            - 'add '\n            - 'SYSTEM\\CurrentControlSet\\Services\\'\n            - ' ImagePath '\n    selection_value:\n        CommandLine|contains|windash: ' -d '\n    condition: all of selection*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.011","id":"T1574.011","name":"Services Registry Permissions Weakness","page":"techniques/enterprise/T1574.011/"}],"data_path":"data/detection-rules/9b0b7ac3-6223-47aa-a3fd-e8f211e637db.json","kind":"sigma"}