[WINDOWS-SYSMON] Registry Hive Dump

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Registry Hive Dump"; program:*Sysmon*; event_id:12,13,14; content:"reg.exe save"; meta_content:"hklm\%sagan%",sam,security,system; reference:url,thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/; classtype:trojan-activity; sid:5013872; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_16, updated_at 2023_02_16, mitre_tactic_id TA0006, mitre_technique_id T1003.002;)