Malicious Service Registration via Direct Registry Write (reg.exe/regedit.exe)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•1•0•3

Detects modifications to Windows service registry keys (ImagePath, Start, or Type) performed by the native reg.exe or regedit.exe command-line utilities. This behavior is often associated with the creation or modification of services for persistence or privilege escalation.