Regedit as Trusted Installer or by Process Hacker

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects when 'regedit.exe' is launched with elevated privileges by either 'TrustedInstaller.exe' or 'ProcessHacker.exe'. This activity is highly suspicious as it indicates an attempt to modify the registry with system-level permissions, potentially for defense evasion or privilege escalation.