Add SafeBoot Keys Via Reg Utility

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•29

Detects the use of 'reg.exe' to add or copy registry keys within the 'SafeBoot' path. This activity is often associated with ransomware attempting to ensure persistence or functionality in Windows Safe Mode, potentially to bypass security products that do not operate in that mode.