Elastic Defend high stable eql

System BootKey Registry Access

Identifies attempts to read the registry values used to calculate the System BootKey, which adversaries can use to recover passwords and other secrets from the registry.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
  [registry where event.action == "query" and
   /* Bootkey/Syskey - GBG, JD, Skew1 */
   registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*") and
   not (process.executable : ("?:\\Windows\\System32\\lsass.exe", "?:\\Windows\\System32\\svchost.exe") and
        user.id in ("S-1-5-18", "S-1-5-19"))
   ]
   [registry where event.action == "query" and
    registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*")]

Field Validations

Loading…

Comments (0)

Loading comments...