Potentially Suspicious Image Load of Offreg.dll

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs.

2026-07-23 00:00:00

None

c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95

attack.defense-impairment attack.persistence attack.t1112

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6169 from @swachchhanda000 - Add LegacyHive Indicators

2026-08-03