Windows reg.exe deletes service registry keys using the delete flag

Alerts on reg.exe command lines that delete entries under the Windows services registry path.

FreeUnreviewedSigmahighv1

windows-reg-exe-deletes-service-registry-keys-using-the-delete-flag-05b2aa93

title: Windows reg.exe deletes service registry keys using the delete flag
id: 21a67282-e053-4a1a-98e7-30d3b56e37d4
status: test
description: This rule flags process creation where reg.exe is executed with a delete action in the context of the services registry path (\SYSTEM\CurrentControlSet\services\). Deleting service registry keys can be used to hinder or remove security-relevant services, supporting defense impairment. It relies on Windows process creation telemetry, matching reg.exe by filename and identifying deletion intent and registry target via command-line substrings.
references:
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_delete_services.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-02-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: reg.exe
    - OriginalFileName: reg.exe
  selection_delete:
    CommandLine|contains: " delete "
  selection_key:
    CommandLine|contains: \SYSTEM\CurrentControlSet\services\
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5
    type: derived

What it detects

This rule flags process creation where reg.exe is executed with a delete action in the context of the services registry path (\SYSTEM\CurrentControlSet\services\). Deleting service registry keys can be used to hinder or remove security-relevant services, supporting defense impairment. It relies on Windows process creation telemetry, matching reg.exe by filename and identifying deletion intent and registry target via command-line substrings.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.