Suspicious Query of MachineGUID

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.