Remote Registry Key Save Activity

Ethan Andrews@eandrews

•updated Jun 10, 2026•6•0•11

Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.