Dumping of Sensitive Hives Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Dec 13, 2023•0•0•0

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.