Dumping of Sensitive Hives Via Reg.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
Source: github.com/SigmaHQ/sigma

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Known false positives

Dumping hives for legitimate purpouse i.e. backup or forensic investigation

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.002` OS Credential Dumping: Security Account Manager `T1003.004` OS Credential Dumping: LSA Secrets `T1003.005` OS Credential Dumping: Cached Domain Credentials

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Dumping of Sensitive Hives Via Reg.EXE
id: fd877b94-9bb5-4191-bb25-d79cbd93c167
related:
    - id: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e
      type: obsolete
    - id: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0
      type: obsolete
status: test
description: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md
    - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
date: 2019-10-22
modified: 2023-12-13
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.005
    - car.2013-07-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_cli_flag:
        CommandLine|contains:
            - ' save '
            - ' export '
            - ' ˢave '
            - ' eˣport '
    selection_cli_hklm:
        CommandLine|contains:
            - 'hklm'
            - 'hk˪m'
            - 'hkey_local_machine'
            - 'hkey_˪ocal_machine'
            - 'hkey_loca˪_machine'
            - 'hkey_˪oca˪_machine'
    selection_cli_hive:
        CommandLine|contains:
            - '\system'
            - '\sam'
            - '\security'
            - '\ˢystem'
            - '\syˢtem'
            - '\ˢyˢtem'
            - '\ˢam'
            - '\ˢecurity'
    condition: all of selection_*
falsepositives:
    - Dumping hives for legitimate purpouse i.e. backup or forensic investigation
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_cli_flag`

selection_cli_flag:
    CommandLine|contains:
        - ' save '
        - ' export '
        - ' ˢave '
        - ' eˣport '

Stage 3: `selection_cli_hklm`

selection_cli_hklm:
    CommandLine|contains:
        - 'hklm'
        - 'hk˪m'
        - 'hkey_local_machine'
        - 'hkey_˪ocal_machine'
        - 'hkey_loca˪_machine'
        - 'hkey_˪oca˪_machine'

Stage 4: `selection_cli_hive`

selection_cli_hive:
    CommandLine|contains:
        - '\system'
        - '\sam'
        - '\security'
        - '\ˢystem'
        - '\syˢtem'
        - '\ˢyˢtem'
        - '\ˢam'
        - '\ˢecurity'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`export` corpus 3 (sigma 3) `eˣport` `save` `ˢave` `\sam` corpus 2 (sigma 1, elastic 1) `\security` `\system` `\syˢtem` `\ˢam` `\ˢecurity` `\ˢystem` `\ˢyˢtem` `hkey_local_machine` corpus 2 (sigma 2) `hkey_loca˪_machine` `hkey_˪ocal_machine` `hkey_˪oca˪_machine` `hklm` corpus 4 (sigma 3, kusto 1) `hk˪m`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`
`OriginalFileName`	eq	`reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq value:"reg.exe"`

Dumping of Sensitive Hives Via Reg.EXE

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_flag

Stage 3: selection_cli_hklm

Stage 4: selection_cli_hive

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli_flag`

Stage 3: `selection_cli_hklm`

Stage 4: `selection_cli_hive`