Registry Modification Via Regini.EXE

Title: Registry Modification Via Regini.EXE
Status: test
Description:Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Regini/
  -https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
Author: Eli Salem, Sander Wiebing, oscd.community
Date: 2020-10-08
modified:2023-02-08
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\regini.exe' OriginalFileName:'REGINI.EXE'   filter:
    CommandLine|re: ':[^ \\]'
  condition:selection and not filter
Falsepositives:
  -Legitimate modification of keys
Level: low