Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent

title: "Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent"
id: d63f16c4-58e1-4ae9-920a-2926acae330e
status: test
description: This rule flags process creation events where regedit.exe is started with a parent process of TrustedInstaller.exe or ProcessHacker.exe. Starting Registry Editor under elevated or unusual parent processes can indicate an attacker is leveraging trusted installer context to perform privileged changes or using tooling to interact with system components. The detection relies on Windows process creation telemetry, matching regedit.exe and the terminating parent image paths.
references:
  - https://twitter.com/1kwpeter/status/1397816101455765504
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-27
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \regedit.exe
    ParentImage|endswith:
      - \TrustedInstaller.exe
      - \ProcessHacker.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 883835a7-df45-43e4-bf1d-4268768afda4
    type: derived