Access To .Reg/.Hive Files By Uncommon Application (337a31c6-46c4-46be-886a-260d7aa78cac)
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Access To .Reg/.Hive Files By Uncommon Application (337a31c6-46c4-46be-886a-260d7aa78cac) | Sigma-Rules | 1 |