Suspicious Registry Hive Dump

[rule]
description = """
Identifies attempts to dump registry hives containing access credential secrets, adversaries may dump registry to
prepare for credential access.
"""
id = "e7358500-1ef6-4f81-ab2d-f8da696375e8"
license = "Elastic License v2"
name = "Suspicious Registry Hive Dump"
os_list = ["windows"]
reference = [
    "https://adsecurity.org/?page_id=1821",
    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.8"

query = '''
any where 
 (
  (event.category == "registry" and event.action == "save" and registry.path : ("HKLM\\SAM", "HKLM\\security", "HKLM\\SECURITY\\Policy\\Secrets") and
   not (process.executable : "?:\\Windows\\System32\\svchost.exe" and
        process.thread.Ext.call_stack_summary == "ntdll.dll|regsvc.dll|rpcrt4.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll")) or
  
  (event.category == "file" and file.Ext.header_bytes like "72656766*" and file.size >= 20000 and 
   process.thread.Ext.call_stack_summary like "*advapi32.dll|Unbacked*" and  
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*advapi32.dll!RegSaveKey*") and 
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and $entry.callsite_trailing_bytes : "?*"))
  ) and 
  process.executable != null and
  not (process.code_signature.subject_name == "VS REVO GROUP OOD" and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files\\Commvault\\ContentStore\\Base\\CLBackup.exe",
                            "?:\\Program Files (x86)\\Commvault\\ContentStore\\Base\\CLBackup.exe",
                            "?:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\RevoUninPro.exe", 
                            "?:\\Program Files (x86)\\VS Revo Group\\Revo Uninstaller Pro\\RevoUninPro.exe", 
                            "?:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASC.exe",
                            "?:\\Program Files\\IObit\\Advanced SystemCare\\ASC.exe",
                            "?:\\Program Files\\Carbonite\\Replication\\DoubleTake.exe", 
                            "?:\\Program Files (x86)\\Carbonite\\Replication\\DoubleTake.exe",
                            "C:\\Program Files\\Microsoft SQL Server\\*\\Setup Bootstrap\\Release\\x64\\setup*.exe")
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.8.0"