Windows Reg.exe Modifies Service ImagePath in HKLM\SYSTEM\CurrentControlSet\Services
Alerts on reg.exe commands that target HKLM\SYSTEM\CurrentControlSet\Services\ImagePath modifications.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-30
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of reg.exe that attempt to modify an existing Windows service ImagePath value stored under HKLM\SYSTEM\CurrentControlSet\Services. Attackers can abuse registry permissions to redirect the service to a different executable, causing their code to run when the service starts. It relies on process creation telemetry, specifically reg.exe command-line arguments containing the targeted service registry path and ImagePath field.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Reg.exe Modifies Service ImagePath in HKLM\SYSTEM\CurrentControlSet\Services
id: 7e738ca5-6ae7-4f94-90a4-8ec674d2b193
status: test
description: This rule identifies executions of reg.exe that attempt to modify an existing Windows service ImagePath value stored under HKLM\SYSTEM\CurrentControlSet\Services. Attackers can abuse registry permissions to redirect the service to a different executable, causing their code to run when the service starts. It relies on process creation telemetry, specifically reg.exe command-line arguments containing the targeted service registry path and ImagePath field.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml
author: frack113, Huntrule Team
date: 2021-12-30
modified: 2024-03-13
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \reg.exe
CommandLine|contains|all:
- "add "
- SYSTEM\CurrentControlSet\Services\
- " ImagePath "
selection_value:
CommandLine|contains|windash: " -d "
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db
type: derived