Sigma rule: Registry Persistence via Service in Safe Mode

Rule

Title

Registry Persistence via Service in Safe Mode

Status

test

Level

high

Author

frack113

Date

2022-04-04

Modified

2025-10-22

File

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\Control\SafeBoot\Minimal\'
        - '\Control\SafeBoot\Network\'
    TargetObject|endswith: '\(Default)'
    Details: 'Service'
filter_optional_sophos:
    Image: 'C:\WINDOWS\system32\msiexec.exe'
    TargetObject|endswith:
        - '\Control\SafeBoot\Minimal\SAVService\(Default)'
        - '\Control\SafeBoot\Network\SAVService\(Default)'
filter_optional_mbamservice:
    Image|endswith: '\MBAMInstallerService.exe'
    TargetObject|endswith: '\MBAMService\(Default)'
    Details: 'Service'
filter_optional_hexnode:
    Image: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
    TargetObject|endswith:
        - '\Control\SafeBoot\Minimal\Hexnode Updater\(Default)'
        - '\Control\SafeBoot\Network\Hexnode Updater\(Default)'
        - '\Control\SafeBoot\Minimal\Hexnode Agent\(Default)'
        - '\Control\SafeBoot\Network\Hexnode Agent\(Default)'
    Details: 'Service'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1564.001

MITRE ATT&CK ids this rule names

• T1564.001

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml