Regedit as Trusted Installer
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Detection logic
selection
Image|endswith: \regedit.exe
ParentImage|endswith:
- \TrustedInstaller.exe
- \ProcessHacker.exeCondition
selectionRaw YAML
title: Regedit as Trusted Installer
id: 883835a7-df45-43e4-bf1d-4268768afda4
status: test
description: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
references:
- https://twitter.com/1kwpeter/status/1397816101455765504
author: Florian Roth (Nextron Systems)
date: 2021-05-27
modified: 2022-10-09
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\regedit.exe'
ParentImage|endswith:
- '\TrustedInstaller.exe'
- '\ProcessHacker.exe'
condition: selection
falsepositives:
- Unlikely
level: highFalse positives
- Unlikely
References
Similar rules
Abused Debug Privilege by Arbitrary Parent Processes
highwindows · Shares T1548
UAC Bypass via Windows Firewall Snap-In Hijack
mediumwindows · Shares T1548
Always Install Elevated MSI Spawned Cmd And Powershell
mediumwindows · Shares T1548
Always Install Elevated Windows Installer
mediumwindows · Shares T1548