huntrule

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.

FreeUnreviewedSigmahighv1
title: Windows System Restore Registry Modification via PowerShell or reg.exe Command Line
id: cb85eca3-ce63-4fbd-9709-b3f4cab7ec2b
related:
  - id: 5de03871-5d46-4539-a82d-3aa992a69a83
    type: similar
  - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9
    type: derived
status: experimental
description: This rule identifies Windows process executions where PowerShell (powershell.exe/pwsh.exe) or reg.exe are used to modify System Restore-related registry policy keys. Disabling or interfering with System Restore can help an attacker reduce recovery options after malicious activity. It relies on process creation telemetry, matching the executable image and OriginalFileName, and key substrings in the CommandLine that indicate adding or setting registry values under specific SystemRestore registry paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-11
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
        - reg.exe
  selection_cli_action:
    CommandLine|contains:
      - " add "
      - Set-ItemProperty
      - New-ItemProperty
  selection_cli_reg_root:
    CommandLine|contains:
      - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
  selection_cli_reg_key:
    CommandLine|contains:
      - DisableConfig
      - DisableSR
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Disable System Restore Through Registry
    technique: T1490
    atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
license: DRL-1.1

What it detects

This rule identifies Windows process executions where PowerShell (powershell.exe/pwsh.exe) or reg.exe are used to modify System Restore-related registry policy keys. Disabling or interfering with System Restore can help an attacker reduce recovery options after malicious activity. It relies on process creation telemetry, matching the executable image and OriginalFileName, and key substrings in the CommandLine that indicate adding or setting registry values under specific SystemRestore registry paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.