cscli scenarios install sigmahq/proc_creation_win_reg_add_safeboot1type: trigger2name: sigmahq/proc_creation_win_reg_add_safeboot3description: |4 Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\reg.exe' || evt.Parsed.OriginalFileName == 'reg.exe') && evt.Parsed.CommandLine contains '\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot' && (evt.Parsed.CommandLine contains ' copy ' || evt.Parsed.CommandLine contains ' add '))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1562.0011516 label: "Add SafeBoot Keys Via Reg Utility"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324