Windows Registry Hive On Wire

Collin Lairamore@Bollinmore

•updated Apr 27, 2026•0•139

This is targeted for YARA used in network sensors like Corelight versus scanning the disk. Windows registry hive (regf format) observed in network file transfer - output of credential-dumping tooling regardless of filename or author. Triggers on SAM, SECURITY, or SYSTEM hives on the wire.