Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

Registry Modification Via Regini.EXE

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Eli Salem, Sander Wiebing, oscd.communityCreated Thu Oct 08Updated Wed Feb 085f60740a-f57b-4e76-82a1-15b6ff2cb134windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        - Image|endswith: '\regini.exe'
        - OriginalFileName: 'REGINI.EXE'
    filter:
        CommandLine|re: ':[^ \\]' # Covered in 77946e79-97f1-45a2-84b4-f37b5c0d8682
    condition: selection and not filter
False Positives

Legitimate modification of keys

References
1
Resolving title…
lolbas-project.github.io
2
Resolving title…
gist.github.com
3
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Related Rules
DerivedDetectionhigh

Suspicious Registry Modification From ADS Via Regini.EXE

Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
5f60740a-f57b-4e76-82a1-15b6ff2cb134
Status
test
Level
low
Type
Detection
Created
Thu Oct 08
Modified
Wed Feb 08
Author
Eli Salem, Sander Wiebing, oscd.community
Path
rules/windows/process_creation/proc_creation_win_regini_execution.yml
Raw Tags
attack.persistenceattack.t1112attack.defense-evasion
View on GitHub