Changing Existing Service ImagePath Value Via Reg.EXE
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection:
Image|endswith: '\reg.exe'
CommandLine|contains|all:
- 'add '
- 'SYSTEM\CurrentControlSet\Services\'
- ' ImagePath '
selection_value:
CommandLine|contains|windash: ' -d '
condition: all of selection*False positive likelihood has not been assessed. Additional context may be needed during triage.