Service List Queried via Remote Registry

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to query the list of services on a remote Windows host via the Remote Registry service. It specifically looks for the string "HKLM\System\CurrentControlSet\Services" over TCP port 445 (SMB/CIFS), which is commonly used for Remote Registry access. A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.