huntrule

Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent

Alerts when regedit.exe is launched by TrustedInstaller.exe or ProcessHacker.exe.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-05-27
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where regedit.exe is started with a parent process of TrustedInstaller.exe or ProcessHacker.exe. Starting Registry Editor under elevated or unusual parent processes can indicate an attacker is leveraging trusted installer context to perform privileged changes or using tooling to interact with system components. The detection relies on Windows process creation telemetry, matching regedit.exe and the terminating parent image paths.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Malicious Azure Elevate Access to User Access Administrator
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Malicious macOS Credential Verification via dscl authonly
Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)
Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)
Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent
Pivot detection · T1548 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.