Detectionhighexperimental

System Restore Registry Modification via CommandLine

Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Wed Mar 117c06ab9b-b1d2-4ba9-b06e-09491ded20d9windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\reg.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
              - 'reg.exe'
    selection_cli_action:
        CommandLine|contains:
            - ' add '
            - 'Set-ItemProperty'
            - 'New-ItemProperty'
    selection_cli_reg_root:
        CommandLine|contains:
            - '\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore'
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore'
    selection_cli_reg_key:
        CommandLine|contains:
            - 'DisableConfig'
            - 'DisableSR'
    condition: all of selection_*