huntrule

Windows regini.exe Execution Leading to Registry Key Changes

Alerts on Windows executions of regini.exe that can import registry changes from text files.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
Eli Salem, Sander Wiebing, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of regini.exe, a Windows utility that imports registry modifications from one or more text files. Attackers and administrators can use regini.exe to change persistence or disable defenses by updating registry values, so monitoring its execution helps identify potentially unauthorized configuration changes. The detection relies on Windows process creation telemetry, matching regini.exe via the executable path and OriginalFileName fields, and excluding cases identified by a command-line pattern.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange
Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837
Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Suspicious Loopback Proxy Server Configured via Registry (via registry_set)
Malicious WDigest Credential Caching Enabled via Registry (via registry_set)
Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm
Malicious Gh0stBins RAT Registry Marker HHClient
Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)
Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)
Windows regini.exe Execution Leading to Registry Key Changes
Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.