Remote Registry Enumeration via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to enumerate remote registry keys via SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "winreg" and "RegQueryValue" in a case-insensitive manner. A threshold is applied to trigger an alert if 20 such events occur within a 30-second window from the same source.