Windows ETW: Kernel-General resets registry hive access bits in temp hive paths

Detects ETW EventID 16 when access bits are reset for Temp \SAM or \SECURITY hives.

FreeReviewedSigma · High · v2

Product: windows
Service: system
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-05-15
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Kernel-General ETW events where a registry hive located under the temporary directory (containing \Temp\SAM or \Temp\SECURITY) has its access bits reset. Resetting hive access bits can indicate attempts to access or extract protected registry data from hives that have not been recognized recently. The detection relies on Windows System ETW telemetry (Microsoft-Windows-Kernel-General, EventID 16) including the hive name in the event.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Credential Dumping via Reg Save of SAM Hive

Malicious Registry Hive Dump via reg save

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

Malicious Credential Hive Copy from Volume Shadow Copy

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

Suspicious SAM Registry Hive Dump to Windows Temp by BianLian

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

Windows ETW: Kernel-General resets registry hive access bits in temp hive paths

Pivot detection · T1003.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-kernel-general-etw-reset-access-bits-for-temp-sam-security-hive-39f919f3

title: "Windows ETW: Kernel-General resets registry hive access bits in temp hive paths"
id: 6a4259e0-46e1-4d8e-a2d4-a7fab9efd85e
related:
  - id: 839dd1e8-eda8-4834-8145-01beeee33acd
    type: obsolete
  - id: 39f919f3-980b-4e6f-a975-8af7e507ef2b
    type: derived
status: test
description: This rule identifies Kernel-General ETW events where a registry hive located under the temporary directory (containing \Temp\SAM or \Temp\SECURITY) has its access bits reset. Resetting hive access bits can indicate attempts to access or extract protected registry data from hives that have not been recognized recently. The detection relies on Windows System ETW telemetry (Microsoft-Windows-Kernel-General, EventID 16) including the hive name in the event.
references:
  - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-15
modified: 2024-01-18
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 16
    Provider_Name: Microsoft-Windows-Kernel-General
    HiveName|contains:
      - \Temp\SAM
      - \Temp\SECURITY
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL