Registry Enumeration for Credential and Config Recon via reg.exe
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
SentinelOne
