Windows Security: SysKey-Relevant LSA Registry Keys Access via Handle and Object Operations

Alerts on access to LSA registry keys used to compute SysKey based on Windows Security handle and registry object events.

FreeUnreviewedSigmahighv1

windows-security-syskey-relevant-lsa-registry-keys-access-via-handle-and-object--9a4ff3b8

title: "Windows Security: SysKey-Relevant LSA Registry Keys Access via Handle and Object Operations"
id: 0355816c-217c-4ef1-a82f-7540274a2e16
status: test
description: This rule identifies Security audit events where a process opens or accesses specific LSA registry key objects associated with SysKey calculation. Attackers may query these keys as part of credential and system security discovery. It relies on Windows Security logs (EventID 4656 and 4663) containing handle request and object access details for registry keys with matching LSA subkey names.
references:
  - https://threathunterplaybook.com/hunts/windows/190625-RegKeyAccessSyskey/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_syskey_registry_access.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-12
modified: 2021-11-27
tags:
  - attack.discovery
  - attack.t1012
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
    ObjectType: key
    ObjectName|endswith:
      - lsa\JD
      - lsa\GBG
      - lsa\Skew1
      - lsa\Data
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9a4ff3b8-6187-4fd2-8e8b-e0eae1129495
    type: derived

What it detects

This rule identifies Security audit events where a process opens or accesses specific LSA registry key objects associated with SysKey calculation. Attackers may query these keys as part of credential and system security discovery. It relies on Windows Security logs (EventID 4656 and 4663) containing handle request and object access details for registry keys with matching LSA subkey names.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.