Remote Access to Sensitive Registry Keys

sequence with maxspan=1m
 [authentication where event.action == "log_on" and
  process.Ext.session_info.logon_type == "Network"] by user.effective.id
 [registry where event.action == "query" and
  process.executable : "?:\\Windows\\System32\\svchost.exe" and
  registry.path :
         ("HKLM\\SAM\\SAM\\Domains\\Account\\*",
          "HKLM\\SECURITY\\Policy\\Secrets\\*",
          "HKLM\\SECURITY\\CACHE*") and
  not registry.path : ("HKLM\\SAM\\SAM\\Domains\\Account\\Users",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names",
                         "HKLM\\SAM\\SAM\\Domains\\Account",
                         "HKLM\\SAM\\SAM\\Domains\\Account\\Aliases\\*")] by user.id