Non-privileged reg.exe or PowerShell registry service configuration changes on Windows

title: Non-privileged reg.exe or PowerShell registry service configuration changes on Windows
id: 55e858ac-570e-46c6-85f0-edf04101d1a9
status: test
description: This rule identifies process executions by non-privileged users running reg.exe or PowerShell commands that include service-related registry paths. It matters because modifying service configuration can enable persistence or interfere with defenses without needing elevated privileges. The detection relies on Windows process creation telemetry, including command line content and integrity level indicators (Medium or S-1-16-8192).
references:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-20-638.jpg
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml
author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community, Huntrule Team
date: 2020-10-05
modified: 2024-12-01
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    - CommandLine|contains|all:
        - "reg "
        - add
    - CommandLine|contains:
        - powershell
        - set-itemproperty
        - " sp "
        - new-itemproperty
  selection_data:
    IntegrityLevel:
      - Medium
      - S-1-16-8192
    CommandLine|contains|all:
      - ControlSet
      - Services
    CommandLine|contains:
      - ImagePath
      - FailureCommand
      - ServiceDLL
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8f02c935-effe-45b3-8fc9-ef8696a9e41d
    type: derived