Windows Security: Detect SAM Registry Hive Handle Requests (EventID 4656)

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

FreeUnreviewedSigmahighv1

windows-security-detect-sam-registry-hive-handle-requests-eventid-4656-f8748f2c

title: "Windows Security: Detect SAM Registry Hive Handle Requests (EventID 4656)"
id: d2938d03-c28c-4971-b91d-b3b407d4aa04
status: test
description: This rule identifies Windows Security events where a process requests a handle to a registry key whose name ends with \SAM. Access to the SAM hive is a common step in credential access workflows, so monitoring these handle requests can help surface suspicious local interaction with sensitive credential storage. The detection relies on EventID 4656 telemetry, specifically the object type, object name, and the handle request details in the Security log.
references:
  - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-12
modified: 2021-11-27
tags:
  - attack.discovery
  - attack.t1012
  - attack.credential-access
  - attack.t1552.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4656
    ObjectType: Key
    ObjectName|endswith: \SAM
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332
    type: derived

What it detects

This rule identifies Windows Security events where a process requests a handle to a registry key whose name ends with \SAM. Access to the SAM hive is a common step in credential access workflows, so monitoring these handle requests can help surface suspicious local interaction with sensitive credential storage. The detection relies on EventID 4656 telemetry, specifically the object type, object name, and the handle request details in the Security log.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.