Windows File Access to .reg and .hive Backups by Uncommon Applications

title: Windows File Access to .reg and .hive Backups by Uncommon Applications
id: b3ec45e7-ffb8-4052-b69b-242b3b207e08
status: test
description: This rule flags file access events targeting paths ending in ".reg" or ".hive" on Windows when the accessing process does not appear to be a commonly observed application path. Attackers may read or stage registry backup artifacts to support persistence, recovery, or configuration changes while attempting to blend in. The detection relies on Windows file access telemetry with process image path and accessed filename suffixes (from the file access event source).
references:
  - https://github.com/tccontre/Reg-Restore-Persistence-Mole
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_access/file_access_win_susp_reg_and_hive.yml
author: frack113, Huntrule Team
date: 2023-09-15
modified: 2024-07-29
tags:
  - attack.defense-impairment
  - attack.t1112
  - attack.persistence
  - detection.threat-hunting
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith:
      - .hive
      - .reg
  filter_main_generic:
    Image|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Third party software installed in the user context might generate a lot of FPs. Heavy baselining and tuning might be required.
level: low
license: DRL-1.1
related:
  - id: 337a31c6-46c4-46be-886a-260d7aa78cac
    type: derived