Windows: Detect regedit.exe creating a PDF file
Alerts when RegEdit.exe creates a .pdf file on Windows.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-07-08
- Updated
- 2026-07-31
What it detects
Identifies file creation events where regedit.exe creates an output file ending in .pdf. This is notable because attackers may use registry export/printing workflows to capture registry contents in an easily shared format. The rule relies on Windows file event telemetry that records the creating process image path and the target filename extension.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-regedit-exe-creating-a-pdf-file-145095eb
title: "Windows: Detect regedit.exe creating a PDF file"
id: cee8b927-b11b-44b8-a8fe-db43c6c79c63
status: test
description: Identifies file creation events where regedit.exe creates an output file ending in .pdf. This is notable because attackers may use registry export/printing workflows to capture registry contents in an easily shared format. The rule relies on Windows file event telemetry that records the creating process image path and the target filename extension.
references:
- https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-08
tags:
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \regedit.exe
TargetFilename|endswith: .pdf
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 145095eb-e273-443b-83d0-f9b519b7867b
type: derived