Skip to main content

reg.exe

Handy for manipulating the registry!

Exporting registry hives with captured TGTs from Rubeus

reg export HKLM\SOFTWARE\MONITOR backup1.reg 

This example is from a TGT-dumping attack that Rubeus can pull off.