BeepRAT T1012/T1082: Bulk Registry Enumeration from AppData/Temp Process (>50 ops/min)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects high-frequency registry access (more than 50 events in a 1-minute window) by processes executing from common temporary, user-profile, or writable directories (e.g., AppData, Temp). This behavior is often associated with malware activity, such as credential dumping, persistence installation, or configuration modification.