Potentially Suspicious Image Load of Offreg.dll

 1title: Potentially Suspicious Image Load of Offreg.dll
 2id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95
 3status: experimental
 4description: |
 5    Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
 6    Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
 7    bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
 8    while evading detection mechanisms that rely on standard registry event logs.    
 9references:
10    - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library
11    - https://github.com/MSNightmare/LegacyHive
12author: Swachchhanda Shrawan Poudel (Nextron Systems)
13date: 2026-07-23
14tags:
15    - attack.defense-impairment
16    - attack.persistence
17    - attack.t1112
18logsource:
19    category: image_load
20    product: windows
21detection:
22    selection:
23        ImageLoaded|endswith: '\offreg.dll'
24    filter_main_system32:
25        Image|startswith:
26            - 'C:\Windows\System32\'
27            - 'C:\Windows\SysWOW64\'
28            - 'C:\Windows\WinSxS\'
29    filter_main_program_files:
30        Image|startswith:
31            - 'C:\Program Files\'
32            - 'C:\Program Files (x86)\'
33    filter_main_appdata_local_programs:
34        Image|startswith: 'C:\Users\'
35        Image|contains: '\AppData\Local\Programs\'
36    filter_main_defender:
37        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
38        Image|endswith: '\MsMpEng.exe'
39    condition: selection and not 1 of filter_main_*
40falsepositives:
41    - Third-party backup or forensic software that performs offline registry parsing
42    - Windows deployment tools (DISM, ADK) run from non-standard paths
43level: medium
44regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml