Rule Info
Name
Uninstall SystemComponent Registry Value Modification via CommandLine
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects modification of the "SystemComponent" registry value in the "Uninstall" key through command line.
Attackers modify this value to hide installed applications from "Programs and Features", often as part of persistence or defense evasion techniques.
Date
2026-06-04 00:00:00
Modified
None
Id
c349d7d6-e22d-4e69-8a99-f5d073c6c6a6
Tags
attack.stealth attack.defense-impairment attack.t1112 attack.persistence attack.t1564
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR