Kimsuky reg query MachineGuid for host fingerprinting

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects the use of reg.exe to query the MachineGuid value from the Windows Registry (HKLM\SOFTWARE\Microsoft\Cryptography). This behavior is often associated with adversary reconnaissance, specifically host fingerprinting, to uniquely identify compromised machines.