Detection rules › Sigma

SAM Registry Hive Handle Request

Severity
high
Author
Roberto Rodriguez @Cyb3rWard0g
Source
upstream

Detects handles requested to SAM registry hive

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552.002 Unsecured Credentials: Credentials in Registry
DiscoveryT1012 Query Registry

Event coverage

ProviderEvent IDTitle
Security-Auditing4656A handle to an object was requested.

Stages and Predicates

Stage 1: selection

ObjectName|endswith: '\SAM'
ObjectType: Key

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ObjectNameends_with
  • \SAM
ObjectTypeeq
  • Key corpus 3 (sigma 3)