reg.exe save/export of SAM, SECURITY, or SYSTEM registry hives
Detects the use of the native Windows 'reg.exe' utility to save or export sensitive registry hives (SAM, SECURITY, or SYSTEM). This activity is a classic technique used by adversaries to perform offline credential dumping.
Microsoft Sentinel (KQL)
