Offline Registry API (offreg.dll) Loaded by a Non-System Process
Detects offreg.dll (Windows Offline Registry Library) being loaded by a process running outside the standard System32/SysWOW64 directories and that is not a known Windows registry-management host process, excluding Malwarebytes' own bundled private copy of the DLL. PrettyPrague uses this library to read the SAM/LSA hive and derive boot-key material outside normal registry API paths. Scoped to the loading process's directory and identity rather than any specific PoC binary name.
Microsoft Sentinel (KQL)
