Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

title: Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch
id: 1dcdc83f-2639-4e1c-b138-5202cd6b844a
status: experimental
description: This rule identifies process executions of Reagentc.exe where the command line includes the /disable switch, indicating an attempt to disable the Windows Recovery Environment (WinRE). Disabling WinRE can reduce the system’s ability to recover from boot issues, which may support impact-focused actions by an attacker. It relies on Windows process creation telemetry including the executable path and command-line content.
references:
  - https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
  - https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml
author: Daniel Koifman (KoifSec), Michael Vilshin, Huntrule Team
date: 2025-07-31
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reagentc.exe
    - OriginalFileName: reagentc.exe
  selection_cli:
    CommandLine|contains|windash: /disable
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activity
level: medium
license: DRL-1.1
related:
  - id: db1c21e4-cd66-4b4e-85ca-590f0780529c
    type: derived