Windows Process Creation: Pypykatz Live Registry Credential Dumping

title: "Windows Process Creation: Pypykatz Live Registry Credential Dumping"
id: c9cf30b1-8aa5-4098-8899-491b105bd4c4
status: test
description: This rule flags Windows process creation events where pypykatz is executed from pypykatz.exe or Python and the command line includes both "live" and "registry". It matches activity consistent with using pypykatz to parse the local Security Account Manager data for credential material. The detection relies on process execution telemetry, including the executable path/name and command-line content.
references:
  - https://github.com/skelsec/pypykatz
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml
author: frack113, Huntrule Team
date: 2022-01-05
modified: 2023-02-05
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \pypykatz.exe
      - \python.exe
    CommandLine|contains|all:
      - live
      - registry
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a29808fd-ef50-49ff-9c7a-59a9b040b404
    type: derived