huntrule

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
Oddvar Moe, Sander Wiebing, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies executions of regedit.exe that export a specific Registry key to a file using the “-E” command-line option. Attackers may use this to collect system configuration data for discovery or later exfiltration. It relies on Windows process creation telemetry, matching on the regedit executable image and the presence of “ -E ” in the command line, while excluding common sensitive key paths.

Reporting behind it

Related detections9 linkedT1012 — drag to rearrange
Registry Query for WDigest
Suspicious Installed Software Enumeration via Registry Uninstall Key Query
Windows WMI StdRegProv Registry Enumeration via wmic.exe
PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging
Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)
Windows Security: Suspicious Registry Access to ADHealthAgent Health Service Agent Keys
Windows Security: Access to Azure AD Health Monitoring Agent Registry Key
Windows Regedit Exports Registry Hives to Files
Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Windows Registry Key Export via regedit.exe (-E) to File
Pivot detection · T1012 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.