Detection of Suspicious Registry Key Modifications via Reg.exe

Adversaries frequently leverage the native Windows registry utility, reg.exe, to achieve persistence, impair security controls, or elevate privileges. By modifying specific registry keys and subkeys, attackers can disable security features, execute arbitrary code at startup, or exfiltrate configuration data. This detection engineering brief focuses on monitoring reg.exe command-line activity targeting high-risk registry paths, such as Windows Defender settings, Winlogon configurations, and OOBE policy keys. These paths are commonly associated with both persistence mechanisms and defense impairment tactics, making them critical observation points for security operations teams seeking to identify unauthorized system modifications.

Impact

Successful exploitation of registry-based persistence or defense impairment can lead to long-term system compromise, unmonitored lateral movement, or the suppression of security alerts, ultimately hindering incident response and forensic analysis capabilities.

Recommendation

Deploy the provided Sigma rule to detect the execution of reg.exe attempting to modify sensitive registry keys. Prioritize investigation of alerts originating from non-administrative service accounts or unauthorized administrative workstations.

• Deploy the Sigma rule below to SIEM platforms to alert on suspicious reg.exe command arguments.
• Review administrative scripts that may legitimately interact with the identified paths and add them to an allowlist if necessary to reduce noise.