Windows Sensitive Registry Hive Dump Via Command Line

The analytic detects the use of `reg.exe` to export Windows Registry hives, specifically `sam`, `system`, or `security`, which may contain sensitive credentials. This activity indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.