Windows: Detect regedit.exe creating a PDF file

What it detects

Identifies file creation events where regedit.exe creates an output file ending in .pdf. This is notable because attackers may use registry export/printing workflows to capture registry contents in an easily shared format. The rule relies on Windows file event telemetry that records the creating process image path and the target filename extension.

Reporting behind it

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-regedit-exe-creating-a-pdf-file-145095eb

title: "Windows: Detect regedit.exe creating a PDF file"
id: cee8b927-b11b-44b8-a8fe-db43c6c79c63
status: test
description: Identifies file creation events where regedit.exe creates an output file ending in .pdf. This is notable because attackers may use registry export/printing workflows to capture registry contents in an easily shared format. The rule relies on Windows file event telemetry that records the creating process image path and the target filename extension.
references:
  - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-08
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \regedit.exe
    TargetFilename|endswith: .pdf
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 145095eb-e273-443b-83d0-f9b519b7867b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL