Offreg.dll Loaded by Unusual Application
This rule detects when 'offreg.dll' is loaded by an application that is not located in common, legitimate Windows or program files directories. 'offreg.dll' is a legitimate Windows DLL related to offline registry manipulation. Its loading by unusual applications outside of expected system paths could indicate an attempt at DLL hijacking, persistence, or other malicious activity, as adversaries might use it to load their own malicious code or manipulate the registry. The rule explicitly excludes known legitimate paths to reduce false positives.
CQL
