Registry hive load targeting non-standard hive files outside ntuser.dat/usrclass.dat
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Microsoft Sentinel (KQL)
