Security Service Disabled Via Reg.EXE

Severity: high
Author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim
Source: upstream

Detects execution of "reg.exe" to disable security services such as Windows Defender.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1562.001` Impair Defenses: Disable or Modify Tools

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `all of selection_reg_add`

CommandLine|contains: add
CommandLine|contains: reg

Stage 2: `all of selection_cli_reg_start`

or:
CommandLine|contains: '\AppIDSvc'
CommandLine|contains: '\MsMpSvc'
CommandLine|contains: '\NisSrv'
CommandLine|contains: '\SecurityHealthService'
CommandLine|contains: '\Sense'
CommandLine|contains: '\UsoSvc'
CommandLine|contains: '\WdBoot'
CommandLine|contains: '\WdFilter'
CommandLine|contains: '\WdNisDrv'
CommandLine|contains: '\WdNisSvc'
CommandLine|contains: '\WinDefend'
CommandLine|contains: '\wscsvc'
CommandLine|contains: '\wuauserv'
CommandLine|contains: 'd 4'
CommandLine|contains: 'v Start'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`\AppIDSvc` `\MsMpSvc` `\NisSrv` `\SecurityHealthService` `\Sense` `\UsoSvc` `\WdBoot` `\WdFilter` `\WdNisDrv` `\WdNisSvc` `\WinDefend` `\wscsvc` `\wuauserv` `add` corpus 16 (sigma 16) `d 4` `reg` corpus 4 (sigma 4) `v Start`