SAM Registry Hive Handle Request

Status: test
Severity: high
Log source: product windows, service security
Author: Roberto Rodriguez @Cyb3rWard0g
Source: github.com/SigmaHQ/sigma

Detects handles requested to SAM registry hive

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.002` Unsecured Credentials: Credentials in Registry
Discovery	`T1012` Query Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.

Rule body

title: SAM Registry Hive Handle Request
id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332
status: test
description: Detects handles requested to SAM registry hive
references:
    - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-12
modified: 2021-11-27
tags:
    - attack.discovery
    - attack.t1012
    - attack.credential-access
    - attack.t1552.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ObjectType: 'Key'
        ObjectName|endswith: '\SAM'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4656
    ObjectType: 'Key'
    ObjectName|endswith: '\SAM'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`\SAM`	`field:"ObjectName" kind:ends_with value:"\SAM"`
`ObjectType`	eq	`Key` corpus 5 (sigma 5)	`field:"ObjectType" kind:eq value:"Key"`

SAM Registry Hive Handle Request

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`