{"id":"d7662ff6-9e97-4596-a61d-9839e32dee8d","title":"Add SafeBoot Keys Via Reg Utility","description":"Detects execution of \"reg.exe\" commands with the \"add\" or \"copy\" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-02","modified":"2024-03-19","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml","source_sha256":"6f8140837e97f23d602424ce55aaabbbafbf5cfe5964f3580b258f128af5ad0c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Add SafeBoot Keys Via Reg Utility\nid: d7662ff6-9e97-4596-a61d-9839e32dee8d\nrelated:\n    - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de\n      type: similar\nstatus: test\ndescription: Detects execution of \"reg.exe\" commands with the \"add\" or \"copy\" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not\nreferences:\n    - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-02\nmodified: 2024-03-19\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_safeboot:\n        CommandLine|contains: '\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot'\n    selection_flag:\n        CommandLine|contains:\n            - ' copy '\n            - ' add '\n    condition: all of selection*\nfalsepositives:\n    - Unlikely\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/d7662ff6-9e97-4596-a61d-9839e32dee8d.json","kind":"sigma"}