Potential Configuration And Service Reconnaissance Via Reg.EXE — Detection Rule
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.