huntrule

Windows Kernel-General ETW: Reset Access Bits for Temp SAM/SECURITY Hive

Detects ETW EventID 16 when access bits are reset for Temp \SAM or \SECURITY hives.

FreeUnreviewedSigmahighv1
title: "Windows Kernel-General ETW: Reset Access Bits for Temp SAM/SECURITY Hive"
id: 6a4259e0-46e1-4d8e-a2d4-a7fab9efd85e
related:
  - id: 839dd1e8-eda8-4834-8145-01beeee33acd
    type: obsolete
  - id: 39f919f3-980b-4e6f-a975-8af7e507ef2b
    type: derived
status: test
description: This rule flags Windows events where the system resets access bits for registry hives named like SAM or SECURITY when the hive path contains the Temp directory. Clearing access bits can enable unauthorized or repeated access attempts to sensitive registry data. The detection relies on Microsoft-Windows-Kernel-General ETW events (EventID 16) and matching HiveName substrings for \Temp\SAM and \Temp\SECURITY.
references:
  - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-15
modified: 2024-01-18
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 16
    Provider_Name: Microsoft-Windows-Kernel-General
    HiveName|contains:
      - \Temp\SAM
      - \Temp\SECURITY
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows events where the system resets access bits for registry hives named like SAM or SECURITY when the hive path contains the Temp directory. Clearing access bits can enable unauthorized or repeated access attempts to sensitive registry data. The detection relies on Microsoft-Windows-Kernel-General ETW events (EventID 16) and matching HiveName substrings for \Temp\SAM and \Temp\SECURITY.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.