huntrule

Windows Process Creation: reg.exe Modifying Group Policy Registry Settings

Flags reg.exe commands targeting Group Policy System registry settings related to security and policy refresh.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-08-19
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process executions where reg.exe is used to modify registry values under the Group Policy System policy path. Attackers can use GPO-related policy changes to enable or alter security-relevant behavior across endpoints without deploying new binaries. The detection relies on process creation telemetry (Image/OriginalFileName and CommandLine) and matches specific Group Policy setting names within the command line.

Reporting behind it

Related detections9 linkedT1484.001 — drag to rearrange
Suspicious Modification of a Sensitive Group Policy - GPO (via security)
Suspicious Group Policy File System Path Redirection via Directory Service Change
Malicious GPO Permission Abuse via SharpGPOAbuse
Suspicious Executable Launched from SYSVOL Share
Malicious SharpGPOAbuse GPO Modification Tool from Public Directory
Suspicious Permissions Changed on a Group Policy - GPO (via security)
Suspicious Executable Launched from Domain Netlogon Share (via process_creation)
Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs
Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs
Windows Process Creation: reg.exe Modifying Group Policy Registry Settings
Pivot detection · T1484.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.