System Restore Registry Modification via CommandLine

Title: System Restore Registry Modification via CommandLine
Status: experimental
Description:Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-11
modified:None
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\reg.exe'
    - OriginalFileName:
      - 'powershell.exe'
      - 'pwsh.dll'
      - 'reg.exe'
  selection_cli_action:
    CommandLine|contains:
      -' add '
      -'Set-ItemProperty'
      -'New-ItemProperty'

  selection_cli_reg_root:
    CommandLine|contains:
      -'\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore'
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore'

  selection_cli_reg_key:
    CommandLine|contains:
      -'DisableConfig'
      -'DisableSR'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high