Windows regini.exe Execution Leading to Registry Key Changes

Alerts on Windows executions of regini.exe that can import registry changes from text files.

FreeUnreviewedSigmalowv1

windows-regini-exe-execution-leading-to-registry-key-changes-5f60740a

title: Windows regini.exe Execution Leading to Registry Key Changes
id: 00419840-84ac-46dc-a40a-d17c6bccd468
related:
  - id: 77946e79-97f1-45a2-84b4-f37b5c0d8682
    type: derived
  - id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134
    type: derived
status: test
description: This rule flags process executions of regini.exe, a Windows utility that imports registry modifications from one or more text files. Attackers and administrators can use regini.exe to change persistence or disable defenses by updating registry values, so monitoring its execution helps identify potentially unauthorized configuration changes. The detection relies on Windows process creation telemetry, matching regini.exe via the executable path and OriginalFileName fields, and excluding cases identified by a command-line pattern.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regini/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regini_execution.yml
author: Eli Salem, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2023-02-08
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \regini.exe
    - OriginalFileName: REGINI.EXE
  filter:
    CommandLine|re: :[^ \\]
  condition: selection and not filter
falsepositives:
  - Legitimate modification of keys
level: low
license: DRL-1.1

What it detects

This rule flags process executions of regini.exe, a Windows utility that imports registry modifications from one or more text files. Attackers and administrators can use regini.exe to change persistence or disable defenses by updating registry values, so monitoring its execution helps identify potentially unauthorized configuration changes. The detection relies on Windows process creation telemetry, matching regini.exe via the executable path and OriginalFileName fields, and excluding cases identified by a command-line pattern.

Known false positives

Legitimate modification of keys

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.