Elastic high stable eql

Credential Acquisition via Registry Hive Dumping

Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
 (?process.pe.original_file_name == "reg.exe" or process.name : "reg.exe") and
 process.args : ("save", "export") and
 process.args : (
   "hklm\\sam", "hklm\\security", "hklm\\system",
   "hkey_local_machine\\sam", "hkey_local_machine\\security", "hkey_local_machine\\system"
 )

Field Validations

Loading…

Comments (0)

Loading comments...