Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Alerts when reg.exe modifies Windows policy settings that disable or restrict internal tools and Explorer/System behavior.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-10-18
Updated: 2026-10-18

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where reg.exe is used with command-line arguments that include registry paths under Windows CurrentVersion policy locations and/or policy values that disable or restrict internal tools and UI elements. Attackers commonly tamper with these settings to impair defense and system functionality, reducing user visibility and operational security tools. The detection relies on telemetry capturing the reg.exe process image name and command-line content referencing specific policy keys and value names.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

Suspicious Flax Typhoon Network Level Authentication Disabled via Registry (via registry_set)

Suspicious Deletion of Terminal Server Client History via reg by UNC1549

Suspicious Registry Class Key Creation for COLDRIVER Persistence

Suspicious Modification of CloudFiles BlockedApps Policy via registry_set

Suspicious Disabling of Malicious Software Removal Tool via registry_set

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-reg-exe-registry-tampering-of-internal-tool-and-explorer-policy-settings-ccc946a3

title: Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)
id: 1e07631a-af26-43e3-8df3-794dbad53cb8
related:
  - id: e2482f8d-3443-4237-b906-cc145d87a076
    type: similar
  - id: ccc946a3-f65a-432a-bb6f-efc6acc1fd27
    type: derived
status: experimental
description: This rule flags process creation events where reg.exe is used with command-line arguments that include registry paths under Windows CurrentVersion policy locations and/or policy values that disable or restrict internal tools and UI elements. Attackers commonly tamper with these settings to impair defense and system functionality, reducing user visibility and operational security tools. The detection relies on telemetry capturing the reg.exe process image name and command-line content referencing specific policy keys and value names.
references:
  - https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
  - https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-18
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cli:
    CommandLine|contains: " add "
  selection_currentversion_explorer_system_root:
    CommandLine|contains:
      - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
      - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
      - SOFTWARE\Policies\Microsoft\Windows\Explorer
      - SOFTWARE\Policies\Microsoft\Windows\System
  selection_currentversion_explorer_system_key:
    CommandLine|contains:
      - ConsentPromptBehaviorAdmin
      - DisableChangePassword
      - DisableCMD
      - DisableLockWorkstation
      - DisableNotificationCenter
      - DisableRegistryTools
      - DisableTaskmgr
      - HideSCAHealth
      - HideSCANetwork
      - HideSCAVolume
      - InactivityTimeoutSecs
      - NoClose
      - NoControlPanel
      - NoDesktop
      - NoDispBackgroundPage
      - NoDispCPL
      - NoDrives
      - NoFileMenu
      - NoFind
      - NoLogOff
      - NoPropertiesMyDocuments
      - NoRun
      - NoSetTaskbar
      - NoTrayContextMenu
      - StartMenuLogOff
      - shutdownwithoutlogon
  condition: all of selection_*
falsepositives:
  - Legitimate use of reg.exe to change system settings
level: medium
simulation:
  - type: atomic-red-team
    name: Modify Registry of Current User Profile - cmd
    technique: T1112
    atomic_guid: 1324796b-d0f6-455a-b4ae-21ffee6aa6b9
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL