Suspicious Windows Recovery Environment Disabled Through Reagentc (via process_creation)

title: Suspicious Windows Recovery Environment Disabled Through Reagentc (via process_creation)
id: ab7eae55-98eb-5573-bad9-aeca2066b92d
status: stable
description: This rule detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE). It enables users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
references:
    - https://attack.mitre.org/techniques/T1490/
    - https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
    - https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
author: Huntrule Team
date: 2026-05-18
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reagentc.exe'
        - OriginalFileName: 'reagentc.exe'
    selection_cli:
        CommandLine|contains|windash: '/disable'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium