BeepRAT Registry Enumeration and Host Recon via reg.exe / systeminfo
Detects host reconnaissance activities performed by BeepRAT (Operation DragonClone) components such as HFY.exe, tcc.exe, or LuaJit.exe. The rule monitors for the spawning of system utilities like reg.exe to query specific registry keys (Windows NT version or Creeper persistence), systeminfo.exe for system enumeration, and wmic.exe for retrieving hardware and system information.
SentinelOne
