Changing Existing Service ImagePath Value Via Reg.EXE

 1title: Changing Existing Service ImagePath Value Via Reg.EXE
 2id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db
 3status: test
 4description: |
 5    Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
 6    Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
 7    Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services    
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
10author: frack113
11date: 2021-12-30
12modified: 2024-03-13
13tags:
14    - attack.privilege-escalation
15    - attack.defense-evasion
16    - attack.persistence
17    - attack.t1574.011
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        Image|endswith: '\reg.exe'
24        CommandLine|contains|all:
25            - 'add '
26            - 'SYSTEM\CurrentControlSet\Services\'
27            - ' ImagePath '
28    selection_value:
29        CommandLine|contains|windash: ' -d '
30    condition: all of selection*
31falsepositives:
32    - Unknown
33level: medium