1200kmSECURITY RESEARCH

1200KM / sigma-rule

Add SafeBoot Keys Via Reg Utility — Sigma Rule

Sigma rule d7662ff6-9e97-4596-a61d-9839e32dee8d. Add SafeBoot Keys Via Reg Utility — Sigma Rule. Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Rule metadata and linked tags

testhighprocess_creationwindowsattack.defense-impairmentattack.t1685

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: high. Source dates: 2022-09-02 / 2024-03-19.

Original logsource
{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6f8140837e97f23d602424ce55aaabbbafbf5cfe5964f3580b258f128af5ad0c

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed
title: Add SafeBoot Keys Via Reg Utility
id: d7662ff6-9e97-4596-a61d-9839e32dee8d
related:
    - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de
      type: similar
status: test
description: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not
references:
    - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-02
modified: 2024-03-19
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_safeboot:
        CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\SafeBoot'
    selection_flag:
        CommandLine|contains:
            - ' copy '
            - ' add '
    condition: all of selection*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml

Original YAML and metadata in JSON

False positives

  • Unlikely

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.