01
detectionlint / library / sigma
Service Registry Key Deleted Via Reg.EXE
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services