Exports Critical Registry Keys To a File

The Windows Registry stores a significant amount of operating system and security information. The SAM (Security Account Manager) hive contains local account password hashes, the SYSTEM hive contains the boot key required to decrypt those hashes, and the SECURITY hive may contain LSA secrets, cached credentials, service account information, and other sensitive security data. An attacker can export these hives to files and analyze themafter exfiltrating.

An attacker may use regedit.exe because it is a legitimate Microsoft utility that already exists on Windows systems. By leveraging a built-in tool, the attacker can blend in with normal administrative activity and avoid introducing additional malware or offensive tooling onto the host. This technique is commonly referred to as “living off the land,” where trusted operating system binaries are abused to perform malicious actions.

Once the registry hives have been exported, the attacker can move the files off the victim machine and perform offline analysis. Offline extraction is attractive because it reduces the amount of suspicious activity occurring on the compromised host. Instead of running credential-dumping tools directly in memory, the attacker can extract password hashes later in a separate environment, making detection more difficult.

The goal is often credential access and privilege escalation. By obtaining local account password hashes from the exported hives, an attacker may attempt to crack weak passwords, recover administrator credentials, reuse credentials on other systems, or conduct pass-the-hash style attacks. Successfully obtaining privileged credentials can enable lateral movement throughout the environment and expansion of the compromise.

Attackers may also export these hives during the reconnaissance phase of an intrusion. Information stored within the registry can reveal details about the operating system, security settings, installed software, domain membership, and other configuration data that help the attacker understand the environment and plan subsequent actions.

Because the exported data can directly support credential theft, privilege escalation, and lateral movement, security teams generally treat unauthorized exports of the SYSTEM, SAM, or SECURITY hives as a high-risk activity that warrants immediate investigation.

Powershell DNSExfiltration

DNS exfiltration is attractive because DNS is one of the most universally allowed protocols in enterprise networks. Almost every endpoint is permitted to send DNS queries to resolve domain names, and security teams often focus more heavily on web, email, or file transfer traffic. MITRE specifically identifies DNS as a protocol that can be abused for data exfiltration under T1048, Exfiltration Over Alternative Protocol.

The technique works by taking a file or collected data, breaking it into small chunks, encoding those chunks into text that is valid within DNS requests, and then embedding the encoded data into DNS queries sent to an attacker-controlled domain. For example, instead of sending a normal DNS query such as ‘server.company.com’, the malware may generate queries containing fragments of stolen data as subdomains. The attacker controls the authoritative DNS server for the destination domain and can reconstruct the original file by reading the DNS requests received by that server. DNS is specifically mentioned by MITRE as a protocol that can be used for alternative-channel data theft.

Tools such as DNSExfiltrator automate this process. The victim system reads the target file, encodes its contents, and sends numerous DNS requests containing the encoded data. The attacker’s DNS server receives the requests, extracts the embedded information, and rebuilds the original file. The entire transfer appears as DNS activity rather than a traditional file upload.

An attacker may choose this method because it can blend into legitimate network traffic. Organizations often generate thousands or millions of DNS requests daily, making malicious queries harder to distinguish. In environments with strict outbound filtering, protocols such as FTP or SMB may be blocked, while DNS remains available because business operations depend on it.

The inclusion of DNS-over-HTTPS (DoH), which the Sigma rule specifically attempts to detect through the -doh parameter, can further increase stealth. With DoH, DNS traffic is encapsulated inside encrypted HTTPS connections, making it more difficult for network monitoring tools to inspect the contents of the DNS requests and identify exfiltrated data.

Seeing PowerShell invoke DNSExfiltrator or observing the characteristic parameter set (-i, -d, -p, -doh, -t) is concerning because it suggests an explicit attempt to transfer data out of the environment through a covert DNS channel rather than through normal communication mechanisms. This behavior is much more indicative of deliberate exfiltration activity than routine administrative use.