Detection of Suspicious Offline Registry Library Usage

The Offline Registry Library (offreg.dll) is a component designed to provide low-level access to Windows registry hives without requiring an active registry API connection. While intended for legitimate administrative and diagnostic tasks, this library is susceptible to abuse by attackers attempting to modify system configurations, persistence mechanisms, or security settings while bypassing standard Windows Registry monitoring telemetry. By loading offreg.dll into a process, an adversary can manipulate registry hives directly on disk, effectively evading audit logs that trigger on standard RegOpenKeyEx or RegSetValueEx calls. Defenders should monitor for unexpected processes loading this DLL from non-system and non-standard application paths.

Impact

Successful abuse of offreg.dll allows attackers to achieve stealthy persistence, disable security features, or modify system policies without generating traditional process-based registry modification alerts. This creates a significant blind spot for security operations teams relying strictly on standard registry event logging.

Recommendation

Deploy the Sigma detection rule below to identify non-standard processes loading offreg.dll in your environment. Prioritize investigation of processes executing from user-writable directories or temporary folders. Validate alerts against known administrative and backup tooling to minimize noise.