Windows System Restore Registry Modification via PowerShell or reg.exe Command Line
Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-03-11
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies Windows process executions where PowerShell (powershell.exe/pwsh.exe) or reg.exe are used to modify System Restore-related registry policy keys. Disabling or interfering with System Restore can help an attacker reduce recovery options after malicious activity. It relies on process creation telemetry, matching the executable image and OriginalFileName, and key substrings in the CommandLine that indicate adding or setting registry values under specific SystemRestore registry paths.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows System Restore Registry Modification via PowerShell or reg.exe Command Line
id: cb85eca3-ce63-4fbd-9709-b3f4cab7ec2b
related:
- id: 5de03871-5d46-4539-a82d-3aa992a69a83
type: similar
- id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9
type: derived
status: experimental
description: This rule identifies Windows process executions where PowerShell (powershell.exe/pwsh.exe) or reg.exe are used to modify System Restore-related registry policy keys. Disabling or interfering with System Restore can help an attacker reduce recovery options after malicious activity. It relies on process creation telemetry, matching the executable image and OriginalFileName, and key substrings in the CommandLine that indicate adding or setting registry values under specific SystemRestore registry paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-11
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- \reg.exe
- OriginalFileName:
- powershell.exe
- pwsh.dll
- reg.exe
selection_cli_action:
CommandLine|contains:
- " add "
- Set-ItemProperty
- New-ItemProperty
selection_cli_reg_root:
CommandLine|contains:
- \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
- \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
selection_cli_reg_key:
CommandLine|contains:
- DisableConfig
- DisableSR
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml
simulation:
- type: atomic-red-team
name: Disable System Restore Through Registry
technique: T1490
atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
license: DRL-1.1