Query: rule covering Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ
Matching passage: Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml
Near-miss passage: Sigma rule: Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. Logsource: windows / process_creation. Rule: title: Microsoft IIS Service Account Password Dumped id: 2d3cdeec-c0db-45b4-aa86-082f7eb75701 status: test description: Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords references: - https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html - https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA - https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/ author: Tim Rauch, Janantha Marasinghe, Elastic (original idea) date: 2022-11-08 modified: 2023-01-22 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_base_name: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_base_list: CommandLine|contains: 'list ' selection_standalone: CommandLine|contains: - ' /config' - ' /xml' - ' -config' - ' -xml' selection_cmd_flags: CommandLine|contains: - ' /@t' - ' /text' - ' /show' - ' -@t' - ' -text' - ' -show' selection_cmd_grep: CommandLine|contains: - :\* - password condition: all of selection_base_* and (selection_standalone or all of selection_cmd_*) falsepositives: - Unknown level: high