LoFP LoFP / rare legitimate add to registry via cli (to these locations)

Techniques

Sample rules

Reg Add Suspicious Paths

Description

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Detection logic

condition: all of selection_*
selection_path:
  CommandLine|contains:
  - \AppDataLow\Software\Microsoft\
  - \Policies\Microsoft\Windows\OOBE
  - \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon
  - \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon
  - \CurrentControlSet\Control\SecurityProviders\WDigest
  - \Microsoft\Windows Defender\
selection_reg:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe