Suspicious Registry Manipulation via reg.exe

This threat brief focuses on the behavioral detection of unauthorized registry modifications performed via the Windows system utility 'reg.exe'. Attackers frequently use reg.exe to modify registry keys for establishing persistence, disabling security tools, or facilitating privilege escalation. The specific indicator of concern is the execution of 'reg.exe' as a child process of 'cmd.exe' when that 'cmd.exe' instance was not launched by the standard user shell 'explorer.exe'. This pattern typically signifies that the command processor was invoked by a secondary process, such as a malicious script, service, or exploitation payload. Monitoring this execution chain helps security operations centers identify potentially anomalous configuration changes on Windows endpoints that may bypass traditional file-based detection.

Attack Chain

1. Attacker gains initial execution through a vulnerability, malicious macro, or sideloaded utility.
2. The malicious process launches 'cmd.exe' to execute shell commands, bypassing standard shell-level audit triggers.
3. The attacker utilizes the spawned 'cmd.exe' to interface with the Windows Registry.
4. 'cmd.exe' invokes 'reg.exe' with arguments to modify specific system configuration keys.
5. Registry values are altered to create new services or modify existing Run keys (T1112).
6. The target system state is changed to allow persistence or disable EDR features.
7. Attacker activity continues with increased privileges or persistent access.

Impact

Successful exploitation allows for arbitrary modification of Windows Registry keys, potentially leading to the disabling of security software, persistent backdoor installation, and privilege escalation. This technique is observed across various intrusion sets targeting the Windows platform, including those documented in DHS report TA18-074A.

Recommendation

Deploy the provided Sigma rules to identify non-standard 'reg.exe' execution chains. Ensure that process creation logging (Sysmon Event ID 1 or Windows Event 4688) is enabled and includes command-line arguments to allow for contextual analysis of registry modifications.