huntrule

Windows Process Creation: reg.exe Modifying Group Policy Registry Settings

Flags reg.exe commands targeting Group Policy System registry settings related to security and policy refresh.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-08-19
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process executions where reg.exe is used to modify registry values under the Group Policy System policy path. Attackers can use GPO-related policy changes to enable or alter security-relevant behavior across endpoints without deploying new binaries. The detection relies on process creation telemetry (Image/OriginalFileName and CommandLine) and matches specific Group Policy setting names within the command line.

Reporting behind it

Related detections9 linkedT1484.001 — drag to rearrange
Malicious GPO Logon Script Planted in SYSVOL Group Policy Path
Suspicious Logon Script Written to SYSVOL Share via Group Policy (via file_event)
Suspicious Group Policy Client-Side Extension Attribute Modification via Directory Service Change
Suspicious Modification of a Sensitive Group Policy - GPO (via security)
Suspicious Group Policy File System Path Redirection via Directory Service Change
Malicious GPO Permission Abuse via SharpGPOAbuse
Suspicious Executable Launched from SYSVOL Share
Malicious SharpGPOAbuse GPO Modification Tool from Public Directory
Suspicious Permissions Changed on a Group Policy - GPO (via security)
Windows Process Creation: reg.exe Modifying Group Policy Registry Settings
Pivot detection · T1484.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.