Access To .Reg/.Hive Files By Uncommon Applications
Detects file access requests to files ending with either the ".hive" or ".reg" extension, which are typically associated with Windows Registry backups. The rule specifically looks for these accesses by applications not located in common system directories (C:\Program Files (x86)\, C:\Program Files\, C:\Windows\System32\, C:\Windows\SysWOW64\), indicating potentially suspicious activity by uncommon or unauthorized applications.
Sigma
