Potential Service Environment Variable Tampering

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects modifications to service environment variables in the Windows registry that could indicate an attempt to tamper with system environment variables. This technique is often used for privilege escalation or persistence by modifying the `SystemRoot` or `windir` variables to point to malicious locations.

2025-06-17 00:00:00

None

3be30fe2-e1ba-46b5-a3b5-8575df05bab0

attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.007

Nextron Sigma feed only (private)