Regini.exe Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Regini is a Windows command-line tool used to modify registry permissions and settings via scriptable .ini files, allowing administrators to automate registry management. Threat actors may abuse regini.exe to escalate privileges or establish persistence by modifying registry keys—such as SAM, SECURITY, or SYSTEM—to manipulate user access rights, enabling RID hijacking or unauthorized credential access. This use case detects executions of regini.exe.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '42185.81281'
title: Regini.exe Execution
description: Regini is a Windows command-line tool used to modify registry permissions
  and settings via scriptable .ini files, allowing administrators to automate registry
  management. Threat actors may abuse regini.exe to escalate privileges or establish
  persistence by modifying registry keys—such as SAM, SECURITY, or SYSTEM—to manipulate
  user access rights, enabling RID hijacking or unauthorized credential access. This
  use case detects executions of regini.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "regini.exe" OR TERM(regini) | where match(process_path, "(?i)\x5cregini\.exe")
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regini/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "regini.exe" OR TERM(regini)

Stage 2: `where`

| where match(process_path, "(?i)\x5cregini\.exe")

Stage 3: `table`

| table _time, host, user, process, process_*, parent_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process_path`	regex_match	`"(?i)\x5cregini.exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"regini.exe"`
1	`regini`