Sigma rule: Potentially Suspicious Image Load of Offreg.dll

Rule

Title

Potentially Suspicious Image Load of Offreg.dll

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-23

File

rules/windows/image_load/image_load_susp_offreg_dll_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith: '\offreg.dll'
filter_main_system32:
    Image|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
filter_main_program_files:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_appdata_local_programs:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Programs\'
filter_main_defender:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Third-party backup or forensic software that performs offline registry parsing
• Windows deployment tools (DISM, ADK) run from non-standard paths

Tags

• attack.defense-impairment
• attack.persistence
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

References

• https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library
• https://github.com/MSNightmare/LegacyHive

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_susp_offreg_dll_load.yml