BeepRAT Registry Enumeration and System Discovery via reg.exe or WMIC

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially suspicious host reconnaissance activities by monitoring for frequent execution of system information gathering utilities (reg.exe, wmic.exe, systeminfo.exe) or registry queries against HKLM software hives. It identifies users or hosts performing an anomalous volume of these activities, which is often indicative of post-exploitation discovery efforts.