{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/telemetry-bypass/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-impairment","persistence","windows","telemetry-bypass"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Offline Registry Library (offreg.dll) is a component designed to provide low-level access to Windows registry hives without requiring an active registry API connection. While intended for legitimate administrative and diagnostic tasks, this library is susceptible to abuse by attackers attempting to modify system configurations, persistence mechanisms, or security settings while bypassing standard Windows Registry monitoring telemetry. By loading offreg.dll into a process, an adversary can manipulate registry hives directly on disk, effectively evading audit logs that trigger on standard RegOpenKeyEx or RegSetValueEx calls. Defenders should monitor for unexpected processes loading this DLL from non-system and non-standard application paths.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of offreg.dll allows attackers to achieve stealthy persistence, disable security features, or modify system policies without generating traditional process-based registry modification alerts. This creates a significant blind spot for security operations teams relying strictly on standard registry event logging.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the Sigma detection rule below to identify non-standard processes loading offreg.dll in your environment. Prioritize investigation of processes executing from user-writable directories or temporary folders. Validate alerts against known administrative and backup tooling to minimize noise.\u003c/p\u003e\n","date_modified":"2026-08-03T08:54:43Z","date_published":"2026-08-03T08:54:43Z","id":"https://feed.craftedsignal.io/briefs/2026-08-suspicious-offreg-load/","summary":"Detection of unauthorized processes loading offreg.dll to perform direct registry hive modification, potentially bypassing standard Windows Registry auditing.","title":"Detection of Suspicious Offline Registry Library Usage","url":"https://feed.craftedsignal.io/briefs/2026-08-suspicious-offreg-load/"}],"language":"en","title":"CraftedSignal Threat Feed - Telemetry-Bypass","version":"https://jsonfeed.org/version/1.1"}