5-Layer Windows Registry Anomaly Detection Using Python

Shreyas Hainalkar - — Fri, 16 May 2025 09:42:57 +0000

🧠 Project Overview

I built a Python-based Windows Registry anomaly detection tool using a 5-layer rule system to detect unauthorized changes.

Core Layers of Detection

Hash Verification – Detect any change by comparing stored vs current registry value hash
Timestamp Monitoring – Identify unusual modification times
User Activity Logging – Check which user made changes
Behavioral Patterns – Track irregular or unexpected change patterns
Access Frequency – Spot suspicious high-frequency access

Tools Used

Python
Windows Registry Access (winreg)
Event Logs (via Sysmon)
Log Analysis Scripts
Planned SIEM integration (e.g., Wazuh)

Why I Built This

I wanted to explore how intrusion detection could be implemented at the registry level without relying on full EDR tools, as a lightweight research-based security project.

Future Plans

Integrate with Wazuh for automated alerting
Package as an open-source CLI utility
Enhance with machine learning for anomaly classification

I'd love to hear your thoughts and suggestions.

.

Shreyas Hainalkar - — Wed, 14 May 2025 11:53:48 +0000

DEV Community: Shreyas Hainalkar -

5-Layer Windows Registry Anomaly Detection Using Python

Why I Built This

.