Sunturai
Back to results
MediumSplunk security contentRico Valdez +1

Reg exe Manipulating Windows Services Registry Keys

The following analytic detects the use of reg.exe to modify registry keys associated with Windows services and their configurations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on…

Description

The following analytic detects the use of reg.exe to modify registry keys associated with Windows services and their configurations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because unauthorized changes to service registry keys can indicate an attempt to establish persistence or escalate privileges. If confirmed malicious, this could allow an attacker to control service behavior, potentially leading to unauthorized code execution or system compromise.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice