System BootKey Registry Access

[rule]
description = """
Identifies attempts to read the registry values used to calculate the System BootKey, which adversaries can use to
recover passwords and other secrets from the registry.
"""
id = "ae7812a1-1329-47b4-9d76-8c7359cda4e4"
license = "Elastic License v2"
name = "System BootKey Registry Access"
os_list = ["windows"]
reference = [
    "http://moyix.blogspot.com/2008/02/syskey-and-sam.html",
    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.28"

query = '''
sequence by process.entity_id with maxspan=1m
  [registry where event.action == "query" and
   /* Bootkey/Syskey - GBG, JD, Skew1 */
   registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*") and
   not (process.executable : ("?:\\Windows\\System32\\lsass.exe", "?:\\Windows\\System32\\svchost.exe") and
        user.id in ("S-1-5-18", "S-1-5-19"))
   ]
   [registry where event.action == "query" and
    registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*")]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"

[[threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"

[[threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"