Sigma rule: Registry Hive File Staged Outside Standard User Profile Path

Rule

Title

Registry Hive File Staged Outside Standard User Profile Path

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-23

File

rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        - '\UsrClass.dat'
        - '\NTUSER.DAT'
filter_main_usrclass:
    TargetFilename|endswith: '\AppData\Local\Microsoft\Windows\UsrClass.dat'
filter_main_ntuser:
    TargetFilename|re|i: '^C:\\Users\\[^\\]+\\NTUSER\.DAT$'
filter_main_system:
    TargetFilename|startswith:
        - 'C:\Windows\System32\config\'
        - 'C:\Windows\SYSVOL\'
        - 'C:\Windows\ServiceProfiles\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Backup or profile migration software
• Forensic acquisition tools

Tags

• attack.privilege-escalation
• attack.t1548
• attack.credential-access
• attack.t1003

MITRE ATT&CK ids this rule names

• T1003
• T1548

References

• https://github.com/MSNightmare/LegacyHive
• https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation.yml