huntrule

Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Daniel Koifman (KoifSec), Michael Vilshin (SigmaHQ), DRL 1.1
Published
2025-07-31
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions of Reagentc.exe where the command line includes the /disable switch, indicating an attempt to disable the Windows Recovery Environment (WinRE). Disabling WinRE can reduce the system’s ability to recover from boot issues, which may support impact-focused actions by an attacker. It relies on Windows process creation telemetry including the executable path and command-line content.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange
Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware
Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware
Malicious Volume Shadow Copy Deletion via vssadmin or WMIC
Malicious Volume Shadow Copy Deletion via vssadmin
Suspicious Free Space Wipe via cipher.exe
Malicious Shadow Copy Deletion Via WMI
Volume Shadow Copy Deletion via vssadmin or wmic
Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)
Malicious Shadow Copy Deletion via vssadmin
Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch
Pivot detection · T1490 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.