Query: Sigma rule for Detects suspicious command line reg.exe tool adding key to RUN key in Registry
Matching passage: Sigma rule: Detects suspicious command line reg.exe tool adding key to RUN key in Registry. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Run Keys Using Reg.EXE id: de587dce-915e-4218-aac4-835ca6af6f70 status: test description: Detects suspicious command line reg.exe tool adding key to RUN key in Registry references: - https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/ - https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-06-28 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons. - Legitimate administrator sets up autorun keys for legitimate reasons. - Discord level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/info.yml
Near-miss passage: Sigma rule: Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notep. Logsource: windows / process_creation. Rule: title: Suspicious Cross-User Process Spawn id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47 status: experimental description: 'Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1134 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \notepad.exe - \calc.exe - \mspaint.exe - \wordpad.exe - \write.exe filter_main_same_user: User|fieldref: ParentUser filter_optional_user_null: User: null filter_optional_parent_null: ParentUser: null filter_optional_empty_user: - ParentUser: - '' - '-' - User: - '' - '-' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - RunAs usage spawning one of the listed binaries under a different account level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml