Potential Suspicious Registry File Imported Via Reg.EXE

Title: Potential Suspicious Registry File Imported Via Reg.EXE
Status: test
Description:Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-01
modified:2023-02-05
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_cli:
    CommandLine|contains: ' import '
  selection_paths:
    CommandLine|contains:
      -'C:\Users\'
      -'%temp%'
      -'%tmp%'
      -'%appdata%'
      -'\AppData\Local\Temp\'
      -'C:\Windows\Temp\'
      -'C:\ProgramData\'

  condition:all of selection_*
Falsepositives:
  -Legitimate import of keys
Level: medium