Reynolds Ransomware Registry Reconnaissance via reg.exe Query
Detects suspicious registry queries and reads indicative of Reynolds ransomware performing system reconnaissance. This rule specifically looks for 'reg.exe query' commands targeting HKLM\SYSTEM\Setup, HKLM\SOFTWARE, HKLM\SYSTEM, and HKCU\SOFTWARE, as well as direct registry event monitoring for reads on 'OOBEInProgress' and 'SystemSetupInProgress' values within the HKLM\SYSTEM\Setup key, while filtering out common legitimate processes.
Microsoft Sentinel (KQL)
