huntrule

Windows Process Creation: reg.exe Adds or Copies SafeBoot Registry Keys

Flags reg.exe with add/copy used against SafeBoot registry keys in Windows process creation logs.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: reg.exe Adds or Copies SafeBoot Registry Keys"
id: 7f865c60-09d7-4fc7-a100-8ce489c3a5a1
related:
  - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de
    type: similar
  - id: d7662ff6-9e97-4596-a61d-9839e32dee8d
    type: derived
status: test
description: This rule identifies Windows process executions where reg.exe is invoked with add/copy flags and a command line referencing the SafeBoot registry path under SYSTEM\CurrentControlSet\Control\SafeBoot. Attackers may modify SafeBoot-related registry keys to influence system startup behavior, which can help malware or ransomware operate under Safe Mode conditions. It relies on process creation telemetry, matching reg.exe execution, command-line contents, and SafeBoot path references.
references:
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-02
modified: 2024-03-19
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_safeboot:
    CommandLine|contains: \SYSTEM\CurrentControlSet\Control\SafeBoot
  selection_flag:
    CommandLine|contains:
      - " copy "
      - " add "
  condition: all of selection*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml
license: DRL-1.1

What it detects

This rule identifies Windows process executions where reg.exe is invoked with add/copy flags and a command line referencing the SafeBoot registry path under SYSTEM\CurrentControlSet\Control\SafeBoot. Attackers may modify SafeBoot-related registry keys to influence system startup behavior, which can help malware or ransomware operate under Safe Mode conditions. It relies on process creation telemetry, matching reg.exe execution, command-line contents, and SafeBoot path references.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.