INCRansom sequential reg.exe export of SAM, SECURITY, and SYSTEM hives
Detects the use of the 'reg.exe' utility to export or save sensitive Windows Registry hives (SAM, SECURITY, SYSTEM) within a short timeframe on a single host. This pattern of credential dumping from the Registry is characteristic of INCRansom activity and other credential harvesting techniques.
Microsoft Sentinel (KQL)
