PDF File Created By RegEdit.EXE

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•1•0•19

Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.