Detection rules › Sigma

Service Registry Key Deleted Via Reg.EXE

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.001 Impair Defenses: Disable or Modify Tools

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: reg.exe
OriginalFileName: reg.exe

Stage 2: all of selection_delete

CommandLine|contains: ' delete '

Stage 3: all of selection_key

CommandLine|contains: '\SYSTEM\CurrentControlSet\services\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • delete corpus 4 (sigma 4)
  • \SYSTEM\CurrentControlSet\services\
Imageends_with
  • reg.exe corpus 3 (sigma 3)
OriginalFileNameeq
  • reg.exe corpus 29 (sigma 29)