Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch
Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).
- Product
- windows
- Category
- process_creation
- Author
- Daniel Koifman (KoifSec), Michael Vilshin (SigmaHQ), DRL 1.1
- Published
- 2025-07-31
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies process executions of Reagentc.exe where the command line includes the /disable switch, indicating an attempt to disable the Windows Recovery Environment (WinRE). Disabling WinRE can reduce the system’s ability to recover from boot issues, which may support impact-focused actions by an attacker. It relies on Windows process creation telemetry including the executable path and command-line content.
Reporting behind it
- elastic.cohttps://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch
id: 1dcdc83f-2639-4e1c-b138-5202cd6b844a
status: experimental
description: This rule identifies process executions of Reagentc.exe where the command line includes the /disable switch, indicating an attempt to disable the Windows Recovery Environment (WinRE). Disabling WinRE can reduce the system’s ability to recover from boot issues, which may support impact-focused actions by an attacker. It relies on Windows process creation telemetry including the executable path and command-line content.
references:
- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml
author: Daniel Koifman (KoifSec), Michael Vilshin, Huntrule Team
date: 2025-07-31
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reagentc.exe
- OriginalFileName: reagentc.exe
selection_cli:
CommandLine|contains|windash: /disable
condition: all of selection_*
falsepositives:
- Legitimate administrative activity
level: medium
license: DRL-1.1
related:
- id: db1c21e4-cd66-4b4e-85ca-590f0780529c
type: derived