Reg.exe Modifying Suspicious Registry Paths

Google SecOps@GoogleSecOps

•updated Jun 25, 2025•0•31

This rule detects the use of the `reg.exe` utility to add or modify registry keys or subkeys in specific suspicious paths. These paths are often abused by adversaries for persistence, defense evasion, or to modify system behavior. The rule specifically looks for modifications to paths related to AppDataLow, Windows Policies, Winlogon, SecurityProviders (WDigest), and Windows Defender.