UNCanny InstallService ActivatableClassId Registry Enumeration via reg.exe
This rule detects attempts to query the Windows Registry for 'WindowsRuntime' and 'ActivatableClassId' using 'reg.exe', specifically looking for 'InstallService' or '/f InstallService' in the command line. This activity could be indicative of an adversary attempting to discover or interact with COM objects or services for persistence or privilege escalation.
Microsoft Sentinel (KQL)
