Sigma Rule Library

PDF File Created By RegEdit.EXE

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.

View on GitHubOpen raw file

Detection logic

selection

Image|endswith: \regedit.exe
TargetFilename|endswith: .pdf

Condition

selection

Raw YAML

title: PDF File Created By RegEdit.EXE
id: 145095eb-e273-443b-83d0-f9b519b7867b
status: test
description: |
    Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process.
    This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.
references:
    - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-08
tags:
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\regedit.exe'
        TargetFilename|endswith: '.pdf'
    condition: selection
falsepositives:
    - Unlikely
level: high

False positives

  • Unlikely

References

Similar rules

.RDP File Created By Uncommon Application

high

windows · Same logsource category (file_event)

APT29 2018 Phishing Campaign File Indicators

critical

windows · Same logsource category (file_event)

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File

medium

windows · Same logsource category (file_event)

Created Files by Microsoft Sync Center

medium

windows · Same logsource category (file_event)