Windows Regedit Exports Registry Hives to Files

Flags regedit.exe command lines exporting SYSTEM/SAM/SECURITY hives from HKLM to files.

FreeUnreviewedSigmahighv1

windows-regedit-exports-registry-hives-to-files-82880171

title: Windows Regedit Exports Registry Hives to Files
id: 4c3f3297-3e35-4264-85f0-92a1e22711e2
related:
  - id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a
    type: similar
  - id: 82880171-b475-4201-b811-e9c826cd5eaa
    type: derived
status: test
description: This rule identifies process executions of regedit.exe where the command line includes the hive export switch and targets HKLM-related hives such as SYSTEM, SAM, and SECURITY. Exporting critical registry hives to files can enable discovery and facilitate offline analysis or credential-related follow-on activity. It relies on Windows process creation telemetry, including the executable name/path and the full command line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2024-03-13
tags:
  - attack.exfiltration
  - attack.discovery
  - attack.t1012
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regedit.exe
    - OriginalFileName: REGEDIT.EXE
  selection_cli_1:
    CommandLine|contains|windash: " -E "
  selection_cli_2:
    CommandLine|contains:
      - hklm
      - hkey_local_machine
  selection_cli_3:
    CommandLine|endswith:
      - \system
      - \sam
      - \security
  condition: all of selection_*
falsepositives:
  - Dumping hives for legitimate purpouse i.e. backup or forensic investigation
level: high
license: DRL-1.1

What it detects

This rule identifies process executions of regedit.exe where the command line includes the hive export switch and targets HKLM-related hives such as SYSTEM, SAM, and SECURITY. Exporting critical registry hives to files can enable discovery and facilitate offline analysis or credential-related follow-on activity. It relies on Windows process creation telemetry, including the executable name/path and the full command line arguments.

Known false positives

Dumping hives for legitimate purpouse i.e. backup or forensic investigation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.