Regedit Export Registry Key To File
Detects the export of a target Registry key to a file using 'regedit.exe' with the '-E' command-line argument. This rule specifically filters out common critical keys (HKLM\SYSTEM, HKLM\SAM, HKLM\SECURITY) to reduce false positives and focus on other potentially malicious registry exports.
Sigma
