Changing Existing Service ImagePath Value Via Reg.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\reg.exe" AND (COMMANDLINE contains "add " AND COMMANDLINE contains "SYSTEM\CurrentControlSet\Services" AND COMMANDLINE contains " ImagePath ")) AND COMMANDLINE contains " -d , /d , –d , —d , ―d " select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
