Elastic medium stable eql

Suspicious Remote Registry Access via SeBackupPrivilege

Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.

View Source

Detection Logic

sequence by winlog.computer_name, winlog.event_data.SubjectLogonId with maxspan=1m
 [iam where host.os.type == "windows" and event.action == "logged-in-special" and
  winlog.event_data.PrivilegeList : "SeBackupPrivilege" and

  /* excluding accounts with existing privileged access */
  not winlog.event_data.PrivilegeList : "SeDebugPrivilege"]
 [any where host.os.type == "windows" and event.code == "5145" and winlog.event_data.RelativeTargetName : "winreg"]

Field Validations

Loading…

Comments (0)

Loading comments...