Kimsuky/JFMBackdoor reg.exe Registry Recon from Script or Sideload Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the use of the Windows registry utility 'reg.exe' to query sensitive registry keys (SYSTEM, SOFTWARE, RUN keys) when executed by suspicious parent processes commonly used for script execution or living-off-the-land techniques (wscript.exe, cscript.exe, fltMC.exe, mshta.exe). This pattern is often indicative of automated discovery or credential harvesting behaviors.