Query: detection rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ
Matching passage: Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml
Near-miss passage: Sigma rule: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID. Logsource: windows / process_creation. Rule: title: LSASS Process Reconnaissance Via Findstr.EXE id: fe63010f-8823-4864-a96b-a7b4a0f7b929 status: test description: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-08-12 modified: 2024-06-04 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: lsass selection_special: CommandLine|contains|windash: - ' /i "lsass' - ' /i lsass.exe' - findstr "lsass - findstr lsass - findstr.exe "lsass - findstr.exe lsass condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml