Broad registry reconnaissance from a user-writable executable
This rule detects when a newly dropped executable, likely from temporary or download directories, performs broad registry reconnaissance. Specifically, it looks for access to registry keys related to software, internet settings, credentials, vaults, and uninstall information. The XQL view includes actor and causality fields to aid in investigation.
Cortex XDR
