New Windows Registry Enumeration Attempt

After infiltrating a network, an attacker might try to enumerate information about potential target devices, such as operating system information. Enumerating Windows registry keys can help the attacker learn how to manipulate the operating system on a target device. Every Windows device has a Windows registry, which is a built-in hierarchical database that contains configuration data in the form of key-value pairs. One method for finding keys is to remotely query the Windows registry over the Windows Remote Registry (WINREG) interface. The attacker sends an API operation within a Microsoft remote procedure call (MSRPC) request to WINREG, and then retrieves a list of subkeys associated with a given key. Overall, this type of enumeration is a precursor to lateral movement, where the attacker compromises targets along an attack path to ultimately achieve their objective.