Windows reg.exe Used to Modify Security Service Start Parameters

Flags reg.exe registry changes that target Start parameters for common security and Windows Defender-related services.

FreeUnreviewedSigmahighv1

windows-reg-exe-used-to-modify-security-service-start-parameters-5e95028c

title: Windows reg.exe Used to Modify Security Service Start Parameters
id: 3a4e9c84-4c5d-484c-9d8c-340bf8699e76
status: test
description: This rule identifies process executions where reg.exe is run with arguments consistent with adding registry configuration to alter the Start value for multiple security-related Windows services. Disabling or changing service start types can impair host defenses by preventing security components from starting. The detection relies on Windows process creation telemetry, specifically command-line contents matching reg.exe usage patterns and targeted service name substrings.
references:
  - https://twitter.com/JohnLaTwC/status/1415295021041979392
  - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1
  - https://vms.drweb.fr/virus/?i=24144899
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml
author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim, Huntrule Team
date: 2021-07-14
modified: 2023-06-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg_add:
    CommandLine|contains|all:
      - reg
      - add
  selection_cli_reg_start:
    CommandLine|contains|all:
      - d 4
      - v Start
    CommandLine|contains:
      - \AppIDSvc
      - \MsMpSvc
      - \NisSrv
      - \SecurityHealthService
      - \Sense
      - \UsoSvc
      - \WdBoot
      - \WdFilter
      - \WdNisDrv
      - \WdNisSvc
      - \WinDefend
      - \wscsvc
      - \wuauserv
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 5e95028c-5229-4214-afae-d653d573d0ec
    type: derived

What it detects

This rule identifies process executions where reg.exe is run with arguments consistent with adding registry configuration to alter the Start value for multiple security-related Windows services. Disabling or changing service start types can impair host defenses by preventing security components from starting. The detection relies on Windows process creation telemetry, specifically command-line contents matching reg.exe usage patterns and targeted service name substrings.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.