Reg Add Suspicious Paths

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects when the 'reg.exe' utility is used to add or modify registry keys or subkeys in suspicious locations. These locations include paths related to AppDataLow, Windows OOBE policies, Winlogon, WDigest security providers, and Windows Defender. Such modifications can be indicative of persistence mechanisms, defense evasion, or other malicious activities.