Security Account Manager (SAM) Registry Access

[rule]
description = """
Identifies attempts to read the Security Account Manager database through the registry, which adversaries can use to
recover password hashes for local accounts.
"""
id = "b6e8c090-f0ec-4c4c-af00-55ac2a9f9b41"
license = "Elastic License v2"
name = "Security Account Manager (SAM) Registry Access"
os_list = ["windows"]
reference = [
    "https://adsecurity.org/?page_id=1821",
    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.41"

query = '''
sequence by process.entity_id
  [process where event.action == "start" and
   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
   not (process.name : "cscript.exe" and process.command_line : "*Tanium*collectAdInfo.vbs*" and
        process.Ext.token.integrity_level_name == "system") and
   not (process.executable : "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif" and
        process.args : "?:\\Windows\\Provisioning\\Microsoft-Desktop-Provisioning-Diagnostic.dat") and
   not (process.parent.executable : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe" and process.name : "reg.exe") and
   not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and
        process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch" and
        process.args : "-ServerName:BackgroundTaskHost.WebAccountProvider") and
   not process.hash.sha256 : "52f145a4ccc0f540a130bedbf04370a842daff1ee8d8361c75a8e0d21a88cf5a" and
   not (process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\windows\\system32\\msiexec.exe") and
        process.parent.executable : "?:\\windows\\sys*\\msiexec.exe" and process.args : "-Embedding" and process.parent.args : "/V") and
   not (process.code_signature.trusted == true and 
        process.code_signature.subject_name : ("Trend Micro, Inc.", "Komodo Laboratories LLC", "Speckled Jay LLC", "Tenable Inc.", "HCL America Inc.", 
                                               "Kaspersky Lab*", "Check Point Software Technologies Ltd.", "AO Kaspersky Lab", "HCL America Inc.",
                                               "Kaspersky Lab JSC", "SentinelOne Inc.", "Nicholas Anderson", "Urs Beckmann")) and
   not process.hash.sha256 : 
                ("8016595ed2344c5322ea8eac1ffd490994417b5c4c745668aa5731ba9129e9fd", 
                 "f7e5566741042ce7a10cf2847279a0dd845ea813fdcb090cd4ee2359584c1496", 
                 "c9283a6b825629e698915b5d948f669c325ea1eb5310a6ff03c640a77e5d6b46",
                 "c9a91e8404a48a24254be9e127e23a40804f9c01674044bf37148e1b68a16814",
                 "c80b04c122161c6b762d8c1dd3aa20391d870d43f53150aecd7a9265b3955e45") and

   not (process.name == "powershell.exe" and process.parent.name == "cmd.exe" and
        process.parent.args == "'HKLM:\\SECURITY\\SAM\\Domains\\Account\\'" and
        process.parent.args == "System.Security.Principal.SecurityIdentifier($_.SID)).Translate([System.Security.Principal.NTAccount]).Value") and
   not (process.name == "cscript.exe" and process.parent.executable : "C:\\Program Files\\ansible\\GTS\\jre\\bin\\java.exe")
   ]
  [registry where event.action == "query" and
   registry.path : "HKLM\\SAM\\SAM\\Domains\\Account\\*" and

    /*
     encrypted password LM/NT bytes are stored in V regval
     under Account\Users key, to reduce noise we exclude following exact reg paths
    */

    not registry.path : ("HKLM\\SAM\\SAM\\Domains\\Account\\Users",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names",
                         "HKLM\\SAM\\SAM\\Domains\\Account",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Aliases\\*") and

     /* LogonUI.exe legitimately reads SAM for user account display on the logon screen */
     not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and
          registry.value : ("UserDontShowInLogonUI", "JC_PREV_V"))
    ]
    until [process where event.action == "end"]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"