reg.exe is a built-in Windows command-line utility for working with the Registry. Administrators use it to query keys, add or delete values, import settings, and export registry data to a file for backup or troubleshooting. Because it is a native tool, it often blends in with normal system activity.
That legitimacy is also why attackers like it. In post-exploitation activity, reg.exe can be used to copy sensitive registry hives, collect configuration data, or stage material for credential theft and persistence. Defenders watch for it running from unusual parent processes, under high-privilege accounts, or alongside suspicious access to SAM, SYSTEM, or SECURITY hives. Context matters: a harmless admin command can become a strong intrusion signal when it appears during application compromise or under a service account that should never touch those artifacts.