{"id":"62e0298b-e994-4189-bc87-bc699aa62d97","title":"Potential Suspicious Registry File Imported Via Reg.EXE","description":"Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-01","modified":"2023-02-05","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate import of keys"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml","source_sha256":"474ae988dc5006ac83411276e80eebe57e4a518dedf497c457f1359bac3abf17","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Suspicious Registry File Imported Via Reg.EXE\nid: 62e0298b-e994-4189-bc87-bc699aa62d97\nrelated:\n    - id: 73bba97f-a82d-42ce-b315-9182e76c57b1\n      type: derived\nstatus: test\ndescription: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import\nauthor: frack113, Nasreddine Bencherchali\ndate: 2022-08-01\nmodified: 2023-02-05\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_cli:\n        CommandLine|contains: ' import '\n    selection_paths:\n        CommandLine|contains:\n            - 'C:\\Users\\'\n            - '%temp%'\n            - '%tmp%'\n            - '%appdata%'\n            - '\\AppData\\Local\\Temp\\'\n            - 'C:\\Windows\\Temp\\'\n            - 'C:\\ProgramData\\'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate import of keys\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/62e0298b-e994-4189-bc87-bc699aa62d97.json","kind":"sigma"}