Dumping of Sensitive Hives Via Reg.EXE

Severity: high
Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
Source: upstream

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.002` OS Credential Dumping: Security Account Manager, `T1003.004` OS Credential Dumping: LSA Secrets, `T1003.005` OS Credential Dumping: Cached Domain Credentials

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\reg.exe'
OriginalFileName: reg.exe

Stage 2: `all of selection_cli_flag`

or:
CommandLine|contains: ' export '
CommandLine|contains: ' eˣport '
CommandLine|contains: ' save '
CommandLine|contains: ' ˢave '

Stage 3: `all of selection_cli_hklm`

or:
CommandLine|contains: hkey_local_machine
CommandLine|contains: 'hkey_loca˪_machine'
CommandLine|contains: 'hkey_˪ocal_machine'
CommandLine|contains: 'hkey_˪oca˪_machine'
CommandLine|contains: hklm
CommandLine|contains: 'hk˪m'

Stage 4: `all of selection_cli_hive`

or:
CommandLine|contains: '\sam'
CommandLine|contains: '\security'
CommandLine|contains: '\system'
CommandLine|contains: '\syˢtem'
CommandLine|contains: '\ˢam'
CommandLine|contains: '\ˢecurity'
CommandLine|contains: '\ˢystem'
CommandLine|contains: '\ˢyˢtem'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`export` corpus 2 (sigma 2) `eˣport` `save` `ˢave` `\sam` `\security` `\system` `\syˢtem` `\ˢam` `\ˢecurity` `\ˢystem` `\ˢyˢtem` `hkey_local_machine` corpus 3 (sigma 3) `hkey_loca˪_machine` `hkey_˪ocal_machine` `hkey_˪oca˪_machine` `hklm` corpus 3 (sigma 3) `hk˪m`
`Image`	ends_with	`\reg.exe` corpus 46 (sigma 46)
`OriginalFileName`	eq	`reg.exe` corpus 29 (sigma 29)

Dumping of Sensitive Hives Via Reg.EXE

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_img

Stage 2: all of selection_cli_flag

Stage 3: all of selection_cli_hklm

Stage 4: all of selection_cli_hive

Indicators

Stage 1: `all of selection_img`

Stage 2: `all of selection_cli_flag`

Stage 3: `all of selection_cli_hklm`

Stage 4: `all of selection_cli_hive`