Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY

Flags reg.exe command lines exporting or saving HKLM registry hives tied to SAM, SYSTEM, and SECURITY.

FreeUnreviewedSigmahighv1

windows-reg-exe-registry-hive-dumping-for-sam-system-and-security-fd877b94

title: Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY
id: bbd69dc1-bb57-4695-be29-3a857d5e7b78
related:
  - id: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e
    type: obsolete
  - id: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0
    type: obsolete
  - id: fd877b94-9bb5-4191-bb25-d79cbd93c167
    type: derived
status: test
description: This rule identifies Windows process executions of reg.exe where the command line includes hive-dump indicators for HKLM and references to the SYSTEM, SAM, and SECURITY hives. Attackers use reg.exe to collect sensitive credential material and secrets from the registry, so correlating reg.exe usage with hive-specific paths helps surface credential-access activity. Telemetry relies on process creation data including the executable image name and the full command line.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md
  - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml
author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113, Huntrule Team
date: 2019-10-22
modified: 2023-12-13
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.005
  - car.2013-07-001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli_flag:
    CommandLine|contains:
      - " save "
      - " export "
      - " ˢave "
      - " eˣport "
  selection_cli_hklm:
    CommandLine|contains:
      - hklm
      - hk˪m
      - hkey_local_machine
      - hkey_˪ocal_machine
      - hkey_loca˪_machine
      - hkey_˪oca˪_machine
  selection_cli_hive:
    CommandLine|contains:
      - \system
      - \sam
      - \security
      - \ˢystem
      - \syˢtem
      - \ˢyˢtem
      - \ˢam
      - \ˢecurity
  condition: all of selection_*
falsepositives:
  - Dumping hives for legitimate purpouse i.e. backup or forensic investigation
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process executions of reg.exe where the command line includes hive-dump indicators for HKLM and references to the SYSTEM, SAM, and SECURITY hives. Attackers use reg.exe to collect sensitive credential material and secrets from the registry, so correlating reg.exe usage with hive-specific paths helps surface credential-access activity. Telemetry relies on process creation data including the executable image name and the full command line.

Known false positives

Dumping hives for legitimate purpouse i.e. backup or forensic investigation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.