Windows Product Key Registry Query

Status: production
Severity: low
Group by: dest, object_file_name, process_id, process_name, signature_id, target_filename
Author: Teoderick Contreras, Splunk
Source: github.com/splunk/security_content

This Analytic detects the execution of a process attempting to access the registry for product key recovery purposes. This behavior could be significant as it might indicate potential malware activity or attempts to bypass security measures or data exfiltration.

Known false positives

Administrator may access this registry for product key recovery purposes.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1012` Query Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

name: Windows Product Key Registry Query
id: 977da0c0-c7d5-45de-8b7e-f79e959ca13d
version: 3
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    This Analytic detects the execution of a process attempting to access the registry for product key recovery purposes.
    This behavior could be significant as it might indicate potential malware activity or attempts to bypass security measures or data exfiltration.
data_source:
    - Windows Event Log Security 4663
search: |-
    `wineventlog_security`
    EventCode=4663
    object_file_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"
    | stats count min(_time) as firstTime max(_time) as lastTime
        by object_file_name object_file_path process_name
           process_path process_id EventCode dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_product_key_registry_query_filter`
how_to_implement: |
    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
known_false_positives: |
    Administrator may access this registry for product key recovery purposes.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$process_name$] attempting to access the registry path [$object_file_path$] on [$dest$].
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

Stages and Predicates

Stage 1: `search`

`wineventlog_security`
EventCode=4663
object_file_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime
    by object_file_name object_file_path process_name
       process_path process_id EventCode dest

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `windows_product_key_registry_query_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4663` corpus 35 (splunk 30, kusto 5)	`field:"EventID" kind:eq value:"4663"`
`object_file_path`	eq	`"*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"`	`field:"TargetFilename" kind:eq`