huntrule

Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent

Alerts when regedit.exe is launched by TrustedInstaller.exe or ProcessHacker.exe.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-05-27
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where regedit.exe is started with a parent process of TrustedInstaller.exe or ProcessHacker.exe. Starting Registry Editor under elevated or unusual parent processes can indicate an attacker is leveraging trusted installer context to perform privileged changes or using tooling to interact with system components. The detection relies on Windows process creation telemetry, matching regedit.exe and the terminating parent image paths.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)
Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)
Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)
Suspicious Sang Loader Execution with Install or PassUAC Arguments
Possible GTFOBins Shell Breakout via Unix Utilities
Malicious Azure Elevate Access to User Access Administrator
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent
Pivot detection · T1548 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.