Sequential reg.exe hive dumps of SECURITY, SAM, and SYSTEM on same host

Duo Tech@duotech

•updated Jul 9, 2026•0•0•0

Detects the use of the native Windows 'reg.exe' utility to export sensitive registry hives (SAM, SECURITY, SYSTEM) commonly targeted by adversaries for offline credential extraction.