Skip to content
Threat Feed

Tag

Regback

1 brief RSS
high advisory

Suspicious Registry Hive Access via RegBack

This rule detects attempts to access registry backup hives (SAM, SECURITY, SYSTEM) via RegBack on Windows systems, which can contain or enable access to credential material.

Endpoint Defense +6 credential-access regback windows
2r 1t