Dumping of Sensitive Hives Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.