Remote Access to Sensitive Registry Keys

[rule]
description = """
Identifies attempts to query remotely sensitive registry keys containing different credential materials via the remote
registry service.
"""
id = "52741ad7-f7cb-47ae-8ea6-5353e5d0b042"
license = "Elastic License v2"
name = "Remote Access to Sensitive Registry Keys"
os_list = ["windows"]
reference = ["https://www.synacktiv.com/publications/lsa-secrets-revisiting-secretsdump"]
version = "1.0.3"

query = '''
sequence with maxspan=1m
 [authentication where event.action == "log_on" and
  process.Ext.session_info.logon_type == "Network"] by user.effective.id
 [registry where event.action == "query" and
  process.executable : "?:\\Windows\\System32\\svchost.exe" and
  registry.path :
         ("HKLM\\SAM\\SAM\\Domains\\Account\\*",
          "HKLM\\SECURITY\\Policy\\Secrets\\*",
          "HKLM\\SECURITY\\CACHE*") and
  not registry.path : ("HKLM\\SAM\\SAM\\Domains\\Account\\Users",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names",
                         "HKLM\\SAM\\SAM\\Domains\\Account",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Aliases\\*")] by user.id
'''

min_endpoint_version = "8.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"

[[threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"

[[threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.15.0"