Add SafeBoot Keys Via Reg Utility

Title: Add SafeBoot Keys Via Reg Utility
Status: test
Description:Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not
References:
  -https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-02
modified:2024-03-19
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_safeboot:
    CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\SafeBoot'
  selection_flag:
    CommandLine|contains:
      -' copy '
      -' add '

  condition:all of selection*
Falsepositives:
  -Unlikely
Level: high