Uncommon File Created By RegEdit.EXE

Nasreddine Bencherchali (Nextron Systems)

Detects the creation files with an uncommon extension by the RegEdit.EXE process. By default the "RegEdit.exe" process would allow for the export of keys via the GUI as either ".reg", ".txt" or "hives". By excluding known extensions, we can hunt for anomalous ones created by "RegEdit.exe" that covers cases such as when a user might choose to print or save a key as a PDF file in order to extract sensitive information and potentially bypass defenses.

Internal Research

2024-07-10 00:00:00

None

c8d41f89-9153-43b2-91f3-45e20239fba9

attack.defense-evasion

Nextron Sigma feed only (private)