Registry Modification Via Regini.EXE

Status: test
Severity: low
Log source: category process_creation, product windows
Author: Eli Salem, Sander Wiebing, oscd.community
Source: github.com/SigmaHQ/sigma

Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Known false positives

Legitimate modification of keys

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Registry Modification Via Regini.EXE
id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134
related:
    - id: 77946e79-97f1-45a2-84b4-f37b5c0d8682
      type: derived
status: test
description: Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Regini/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
author: Eli Salem, Sander Wiebing, oscd.community
date: 2020-10-08
modified: 2023-02-08
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\regini.exe'
        - OriginalFileName: 'REGINI.EXE'
    filter:
        CommandLine|re: ':[^ \\]' # Covered in 77946e79-97f1-45a2-84b4-f37b5c0d8682
    condition: selection and not filter
falsepositives:
    - Legitimate modification of keys
level: low

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    - Image|endswith: '\regini.exe'
    - OriginalFileName: 'REGINI.EXE'

Stage 2: `not filter`

filter:
    CommandLine|re: ':[^ \\]'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	regex_match	`:[^ \]`	`excludes:CommandLine` `field:"CommandLine" value:":[^ \]"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\regini.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\regini.exe"`
`OriginalFileName`	eq	`REGINI.EXE` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"REGINI.EXE"`