SafeBoot Registry Key Deletion via Reg.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•32

Detects the use of the 'reg.exe' utility to delete SafeBoot registry keys. This activity is often performed by attackers to disable security products or interfere with system recovery mechanisms, particularly in the context of defense evasion.