Windows: RegEdit.exe creating a .pdf file

Alerts when RegEdit.exe creates a .pdf file on Windows.

FreeUnreviewedSigmahighv1

windows-regedit-exe-creating-a-pdf-file-145095eb

title: "Windows: RegEdit.exe creating a .pdf file"
id: cee8b927-b11b-44b8-a8fe-db43c6c79c63
status: test
description: This rule flags when the Windows RegEdit.exe process creates a file whose name ends with the .pdf extension. Such activity can indicate an attempt to export registry contents or save output to a PDF, potentially to collect or exfiltrate information while disguising it as a document. It relies on Windows file creation telemetry capturing the creating process image path and the target filename.
references:
  - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-08
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \regedit.exe
    TargetFilename|endswith: .pdf
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 145095eb-e273-443b-83d0-f9b519b7867b
    type: derived

What it detects

This rule flags when the Windows RegEdit.exe process creates a file whose name ends with the .pdf extension. Such activity can indicate an attempt to export registry contents or save output to a PDF, potentially to collect or exfiltrate information while disguising it as a document. It relies on Windows file creation telemetry capturing the creating process image path and the target filename.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.