Windows Security Event 4656: SAM Registry Hive Key Handle Requested

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.002Credentials in Registry
Discovery
- T1012Query Registry
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security auditing events where a process requests a handle to a registry key whose name ends with '\SAM'. Access to the SAM hive is significant because it can indicate preparation for credential access or other sensitive account-related operations. It relies on Security log Event ID 4656 telemetry with Key object details, including ObjectType and ObjectName suffix matching for '\SAM'.

Reporting behind it

Related detections9 linkedT1012 — drag to rearrange

Registry Query for WDigest

Suspicious Installed Software Enumeration via Registry Uninstall Key Query

Suspicious Registry Query for Stored Credentials (via process_creation)

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Windows reg.exe Registry Save/Export of Third-Party Credential Paths

PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Windows CLI Enumeration of 3rd-Party Credential Registry Keys

Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Pivot detection · T1012 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-detect-sam-registry-hive-handle-requests-eventid-4656-f8748f2c

title: "Windows Security Event 4656: SAM Registry Hive Key Handle Requested"
id: d2938d03-c28c-4971-b91d-b3b407d4aa04
status: test
description: This rule flags Windows Security auditing events where a process requests a handle to a registry key whose name ends with '\SAM'. Access to the SAM hive is significant because it can indicate preparation for credential access or other sensitive account-related operations. It relies on Security log Event ID 4656 telemetry with Key object details, including ObjectType and ObjectName suffix matching for '\SAM'.
references:
  - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-12
modified: 2021-11-27
tags:
  - attack.discovery
  - attack.t1012
  - attack.credential-access
  - attack.t1552.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4656
    ObjectType: Key
    ObjectName|endswith: \SAM
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL