Windows reg.exe importing .reg files from common user and temp directories

Flags reg.exe importing .reg files when the command line references user or temp directories.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2022-08-01
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creations where reg.exe is used to import .reg files, with the command line containing an import action and the command referencing common user and temporary paths (e.g., %temp%, %tmp%, %appdata%, AppData Local Temp, Windows Temp, and ProgramData). Such activity matters because importing registry files can change system settings and persistence-relevant configurations. The detection relies on Windows process creation telemetry, including the process image/original filename and the command line content and path strings.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

Malicious Gh0stBins RAT Registry Marker HHClient

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

Windows reg.exe importing .reg files from common user and temp directories

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-reg-exe-importing-reg-files-from-common-user-and-temp-directories-62e0298b

title: Windows reg.exe importing .reg files from common user and temp directories
id: e4a38e75-311c-44e1-8463-ad4335993a77
related:
  - id: 73bba97f-a82d-42ce-b315-9182e76c57b1
    type: derived
  - id: 62e0298b-e994-4189-bc87-bc699aa62d97
    type: derived
status: test
description: This rule identifies process creations where reg.exe is used to import .reg files, with the command line containing an import action and the command referencing common user and temporary paths (e.g., %temp%, %tmp%, %appdata%, AppData Local Temp, Windows Temp, and ProgramData). Such activity matters because importing registry files can change system settings and persistence-relevant configurations. The detection relies on Windows process creation telemetry, including the process image/original filename and the command line content and path strings.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-01
modified: 2023-02-05
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli:
    CommandLine|contains: " import "
  selection_paths:
    CommandLine|contains:
      - C:\Users\
      - "%temp%"
      - "%tmp%"
      - "%appdata%"
      - \AppData\Local\Temp\
      - C:\Windows\Temp\
      - C:\ProgramData\
  condition: all of selection_*
falsepositives:
  - Legitimate import of keys
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL