Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives, bypassing the standard Windows Registry API and its associated audit telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection that relies on registry event logs. The rule triggers when an image-load event shows ImageLoaded ends with "\\offreg.dll" but only if the image path is not in common legitimate locations (System32/SysWOW64/WinSxS, Program Files, Program Files (x86), AppData Local Programs, or the Defender platform path). The final condition requires a match on the selection and the absence of any of the allowed-path filters, highlighting loads from non-standard directories as suspicious. This aligns with persistence or defense-impairment concerns and maps to T1112 (Modify Registry). False positives may arise from legitimate third-party backup/forensic tools that read offline registries or Windows deployment tools (DISM, ADK) executed from non-standard paths. The rule is tagged as attack.persistence and attack.t1112, with a medium severity and experimental status. False-positive reduction relies on path-based exclusions, while true positives would involve non-standard deployments or tools loading offreg.dll to alter offline hives without standard auditing.