Windows File Access to .hive and .reg Backups by Uncommon Applications

title: Windows File Access to .hive and .reg Backups by Uncommon Applications
id: b3ec45e7-ffb8-4052-b69b-242b3b207e08
status: test
description: This rule flags Windows file access events where the accessed file name ends in .hive or .reg, extensions commonly associated with Windows Registry backup files. Attackers may read or interact with these backup artifacts to support persistence, recovery, or modification of registry data. It relies on Windows file access telemetry that includes the accessed file name and the initiating process image path, and it reduces noise by excluding requests from common system and program directory paths.
references:
  - https://github.com/tccontre/Reg-Restore-Persistence-Mole
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_access/file_access_win_susp_reg_and_hive.yml
author: frack113, Huntrule Team
date: 2023-09-15
modified: 2024-07-29
tags:
  - attack.defense-impairment
  - attack.t1112
  - attack.persistence
  - detection.threat-hunting
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith:
      - .hive
      - .reg
  filter_main_generic:
    Image|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Third party software installed in the user context might generate a lot of FPs. Heavy baselining and tuning might be required.
level: low
license: DRL-1.1
related:
  - id: 337a31c6-46c4-46be-886a-260d7aa78cac
    type: derived