{"id":"b7e2a8d4-74bb-4b78-adc9-3f92af2d4829","title":"Reg Add Suspicious Paths","description":"Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-19","modified":"2022-10-10","tags":["attack.persistence","attack.defense-impairment","attack.t1112","attack.t1685"],"technique_ids":["T1112","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Rare legitimate add to registry via cli (to these locations)"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md","https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md","https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml","source_sha256":"57894b6a450ed5936141bd8b880099dd3e2e105d21f9d10a6c473021ebff5dbe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Reg Add Suspicious Paths\nid: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829\nstatus: test\ndescription: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md\n    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-19\nmodified: 2022-10-10\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_reg:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_path:\n        CommandLine|contains:\n            # Add more suspicious registry locations below\n            - '\\AppDataLow\\Software\\Microsoft\\'\n            - '\\Policies\\Microsoft\\Windows\\OOBE'\n            - '\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n            - '\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon'\n            - '\\CurrentControlSet\\Control\\SecurityProviders\\WDigest'\n            - '\\Microsoft\\Windows Defender\\'\n    condition: all of selection_*\nfalsepositives:\n    - Rare legitimate add to registry via cli (to these locations)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/b7e2a8d4-74bb-4b78-adc9-3f92af2d4829.json","kind":"sigma"}