Exports Critical Registry Keys To a File

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•25

Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.