Sunturai
Back to results
MediumSigmaHQSwachchhanda Shrawan Poudel (Nextron Systems)

Potentially Suspicious Image Load of Offreg.dll

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its…

Description

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
image_load

Known benign triggers

  • Third-party backup or forensic software that performs offline registry parsing
  • Windows deployment tools (DISM, ADK) run from non-standard paths

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice