Changing Existing Service ImagePath Value Via Reg.EXE
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
Sigma
