Windows Reg.exe Modifies Service ImagePath in HKLM\SYSTEM\CurrentControlSet\Services

title: Windows Reg.exe Modifies Service ImagePath in HKLM\SYSTEM\CurrentControlSet\Services
id: 7e738ca5-6ae7-4f94-90a4-8ec674d2b193
status: test
description: This rule identifies executions of reg.exe that attempt to modify an existing Windows service ImagePath value stored under HKLM\SYSTEM\CurrentControlSet\Services. Attackers can abuse registry permissions to redirect the service to a different executable, causing their code to run when the service starts. It relies on process creation telemetry, specifically reg.exe command-line arguments containing the targeted service registry path and ImagePath field.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml
author: frack113, Huntrule Team
date: 2021-12-30
modified: 2024-03-13
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
      - "add "
      - SYSTEM\CurrentControlSet\Services\
      - " ImagePath "
  selection_value:
    CommandLine|contains|windash: " -d "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db
    type: derived