huntrule

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

FreeUnreviewedSigmalowv1
title: Windows Registry Key Export via regedit.exe (-E) to File
id: 8d712245-0e25-44db-93e9-eea44ad25385
related:
  - id: 82880171-b475-4201-b811-e9c826cd5eaa
    type: similar
  - id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a
    type: derived
status: test
description: This rule identifies executions of regedit.exe that export a specific Registry key to a file using the “-E” command-line option. Attackers may use this to collect system configuration data for discovery or later exfiltration. It relies on Windows process creation telemetry, matching on the regedit executable image and the presence of “ -E ” in the command line, while excluding common sensitive key paths.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2024-03-13
tags:
  - attack.exfiltration
  - attack.discovery
  - attack.t1012
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regedit.exe
    - OriginalFileName: REGEDIT.EXE
  selection_cli:
    CommandLine|contains|windash: " -E "
  filter_1:
    CommandLine|contains:
      - hklm
      - hkey_local_machine
  filter_2:
    CommandLine|endswith:
      - \system
      - \sam
      - \security
  condition: all of selection_* and not all of filter_*
falsepositives:
  - Legitimate export of keys
level: low
license: DRL-1.1

What it detects

This rule identifies executions of regedit.exe that export a specific Registry key to a file using the “-E” command-line option. Attackers may use this to collect system configuration data for discovery or later exfiltration. It relies on Windows process creation telemetry, matching on the regedit executable image and the presence of “ -E ” in the command line, while excluding common sensitive key paths.

Known false positives

  • Legitimate export of keys

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.