Add SafeBoot Keys Via Reg Utility

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•2

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not