Enumeration for Credentials in Registry using Reg.exe
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
Sigma
