LoFP LoFP / windows deployment tools (dism, adk) run from non-standard paths

Techniques

Sample rules

Potentially Suspicious Image Load of Offreg.dll

Description

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_appdata_local_programs:
  Image|contains: \AppData\Local\Programs\
  Image|startswith: C:\Users\
filter_main_defender:
  Image|endswith: \MsMpEng.exe
  Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
filter_main_program_files:
  Image|startswith:
  - C:\Program Files\
  - C:\Program Files (x86)\
filter_main_system32:
  Image|startswith:
  - C:\Windows\System32\
  - C:\Windows\SysWOW64\
  - C:\Windows\WinSxS\
selection:
  ImageLoaded|endswith: \offreg.dll