Registry Hive File Staged Outside Standard User Profile Path

 1title: Registry Hive File Staged Outside Standard User Profile Path
 2id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
 3status: experimental
 4description: |
 5    Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
 6    These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
 7    Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
 8    for persistence, privilege escalation, or dump user registry hives for credential harvesting.    
 9references:
10    - https://github.com/MSNightmare/LegacyHive
11    - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
12author: Swachchhanda Shrawan Poudel (Nextron Systems)
13date: 2026-07-23
14tags:
15    - attack.privilege-escalation
16    - attack.t1548
17    - attack.credential-access
18    - attack.t1003
19logsource:
20    category: file_event
21    product: windows
22detection:
23    selection:
24        TargetFilename|endswith:
25            - '\UsrClass.dat'
26            - '\NTUSER.DAT'
27    filter_main_usrclass:
28        TargetFilename|endswith: '\AppData\Local\Microsoft\Windows\UsrClass.dat'
29    filter_main_ntuser:
30        TargetFilename|re|i: '^C:\\Users\\[^\\]+\\NTUSER\.DAT$'
31    filter_main_system:
32        TargetFilename|startswith:
33            - 'C:\Windows\System32\config\'
34            - 'C:\Windows\SYSVOL\'
35            - 'C:\Windows\ServiceProfiles\'
36    condition: selection and not 1 of filter_main_*
37falsepositives:
38    - Backup or profile migration software
39    - Forensic acquisition tools
40level: high
41regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml