SAM Registry Hive Handle Request

 1title: SAM Registry Hive Handle Request
 2id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332
 3status: test
 4description: Detects handles requested to SAM registry hive
 5references:
 6    - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
 7author: Roberto Rodriguez @Cyb3rWard0g
 8date: 2019-08-12
 9modified: 2021-11-27
10tags:
11    - attack.discovery
12    - attack.t1012
13    - attack.credential-access
14    - attack.t1552.002
15logsource:
16    product: windows
17    service: security
18detection:
19    selection:
20        EventID: 4656
21        ObjectType: 'Key'
22        ObjectName|endswith: '\SAM'
23    condition: selection
24falsepositives:
25    - Unknown
26level: high

References

• SAM Registry Hive Handle Request — Threat Hunter Playbook

  Technical Context Every computer that runs Windows has its own local domain; that is, it has an account database for accounts that are specific to that computer. Conceptually,this is an account dat...

  
  Read More

Related rules

• Cisco Sniffing
• Exports Critical Registry Keys To a File
• Exports Registry Key To a File
• HackTool - CrackMapExec Execution
• Windows Pcap Drivers