Add SafeBoot Keys Via Reg Utility

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1562.001` Impair Defenses: Disable or Modify Tools

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\reg.exe'
OriginalFileName: reg.exe

Stage 2: `all of selection_safeboot`

CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\SafeBoot'

Stage 3: `all of selection_flag`

or:
CommandLine|contains: ' add '
CommandLine|contains: ' copy '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`add` corpus 11 (sigma 11) `copy` corpus 4 (sigma 4) `\SYSTEM\CurrentControlSet\Control\SafeBoot` corpus 2 (sigma 2)
`Image`	ends_with	`\reg.exe` corpus 46 (sigma 46)
`OriginalFileName`	eq	`reg.exe` corpus 29 (sigma 29)