SOC117: Investigating a Suspicious .REG File — From SIEM Alert to Incident Closure form Lets defend Labs.

6 min readJul 28, 2026

Hello guys! I am back with an interesting alert, and today we are diving into a cool Windows forensics concept.

This is an alert from the LetsDefend platform that I’ve been meaning to write about, and it is going to be a lot of fun to solve.

Let’s head right over to the dashboard and check out this alert generated by our SIEM tool.

Quick Intros:

What is LetsDefend?

LetsDefend is a hands-on cyber security training platform that helps beginners and experts practice real-world blue team skills inside a simulated Security Operations Center (SOC).

What is a Reg File?

A .reg file is a plain-text Windows Registry file used to import or export settings in the Windows Registry. a plain-text Windows Registry file used to import or export settings in the Windows Registry. It acts as a set of instructions for the operating system, allowing you to quickly add, modify, or delete system and software configurations without having to navigate the Registry Editor manually.

Alert Incident Response Playbook: Event ID 50

Alert: Suspicious .reg File Downloaded

Target Endpoint: 172.16.17[.]51

Get Jayanth K’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Objective: Validate the alert to determine if it is a True Positive or False Positive.

Response Lifecycle (Table of Contents)

Queue Management: Check SOC ticket queue
Assignment: Take ownership
Documentation: Create case
Framework: Utilize Playbook
Phase 1: Detection
Phase 2: Analysis
Phase 3: Containment
Phase 4: Remediation
Reporting: Log Artifacts & IOCs
Resolution: Close ticket

As given in above screen shot we had Check SOC ticket queue in Letsdenfed and assigned the alert named Suspicious .reg File Downloaded.

It seems that a security tool successfully BLOCKED a malicious file action.

lets create a case and Utilize Playbook to resolve the alert.

Detection

As Analysts, we must verify whether this alert is a true positive or a false positive.

Our SIEM fired off an alert after a suspicious registry file appeared in our environment.

Our first step is to define the threat indicator.

After considering alert and options the “other” option is our pick.

Our alert revealed that the action was blocked from our environment, so it has been “Quarantined”. Now let’s analyze the file in question. We can query the file hash on Virustotal, followed by the download link from our alert.

File hash: f705ac114767397fb5e7cd1603e70954

We get a clean report, but this does not mean the action was not malicious with intent.

VirusTotal analysis revealed that the ZIP file was hosted on an Amazon S3 bucket and community threat intelligence links the domain to the SilentBuilder malware family, a dropper/downloader associated with a Conti subgroup.

Our download link included in the alert has been flagged as malicious on Virustotal.

Since the action was blocked, we can select “Not Accessed” since it never reached our end user.

During the investigation, we identified a malicious file hash and a malicious URL associated with the alert. To prevent further compromise, both Indicators of Compromise (IOCs) were added to the organization’s EDR blocklist, ensuring they are blocked across all managed endpoints.

Lets close the alert with closure notes:

On February 06, 2021, at 01:58 PM, our SIEM generated an alert for a suspicious .reg file originating from endpoint 172.16.17.5. The malicious registry file was successfully blocked before execution on the endpoint. During the investigation, we analyzed the associated file hash and download URL, both of which were confirmed to be malicious. Further sandbox analysis using ANY.RUN revealed that the .reg file modifies registry settings, creates folders, enumerates system information, launches applications, and executes commands. Since the malicious activity was prevented before execution, no additional containment actions were required. To strengthen our defenses, the identified file hash and malicious URL were added to the EDR blocklist, preventing future execution across all managed endpoints.

Hence, this investigation is now complete.

We can now close this alert as a True Positive. The security controls successfully detected and blocked the malicious .reg file before it could execute. All identified Indicators of Compromise (IOCs), including the malicious file hash and URL, have been added to the EDR blocklist to prevent future execution. No evidence of endpoint compromise or malicious execution was found during the investigation; therefore, no containment actions were required. The incident has been successfully investigated, remediated, and closed.

Conclusion

In this SOC117 — Suspicious .REG File investigation, we analyzed a malicious Windows Registry (.reg) file that was detected by our SIEM during routine security monitoring. By examining the associated file hash, download URL, and sandbox analysis results from ANY.RUN, we confirmed that the file was designed to modify registry settings, execute commands, and establish persistence—behaviors commonly observed in modern malware campaigns.

Fortunately, the security controls successfully blocked the malicious file before it could execute, preventing any impact on the endpoint. The associated Indicators of Compromise (IOCs), including the file hash and download URL, were validated as malicious and added to the EDR blocklist to protect all managed endpoints. Since no evidence of successful execution or endpoint compromise was found, no additional containment actions were required, and the incident was confidently closed as a True Positive.

This investigation demonstrates the importance of combining SIEM alerts, threat intelligence, sandbox analysis, and endpoint protection to quickly validate threats and minimize organizational risk.

Thank you for taking the time to read this walkthrough. I hope this investigation provided valuable insights into how SOC analysts approach registry-based malware incidents in real-world environments. If you found this article helpful, consider following my journey for more SOC investigations, threat hunting, DFIR, and cybersecurity content. See you in the next blog — stay curious, keep investigating, and stay secure!