Registry Hive Bulk Query for System Recon

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects a high volume of Registry Hive bulk queries for system reconnaissance activities. Specifically, it looks for 30 or more 'RegEnumKey' operations over TCP port 445 (SMB) within a 30-second window, originating from a single source IP address and directed towards the protected network. This behavior can indicate an attacker attempting to enumerate registry keys to gather information about the system.