Registry Export of SYSTEM Hive to Temp

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•7

Detects reg.exe saving the SYSTEM hive to \Windows\Temp\. This activity is often associated with credential dumping techniques where adversaries extract the SAM database for offline cracking.