{"id":"39f919f3-980b-4e6f-a975-8af7e507ef2b","title":"Critical Hive In Suspicious Location Access Bits Cleared","description":"Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.\nThis occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).\nRegistry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-05-15","modified":"2024-01-18","tags":["attack.credential-access","attack.t1003.002"],"technique_ids":["T1003.002"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Unknown"],"references":["https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md"],"source_path":"rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml","source_sha256":"5b25a63b01fb5a1449cd2ca8cf2d159f91a4cfac585e8cfd576f30c499bce33f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Critical Hive In Suspicious Location Access Bits Cleared\nid: 39f919f3-980b-4e6f-a975-8af7e507ef2b\nrelated:\n    - id: 839dd1e8-eda8-4834-8145-01beeee33acd\n      type: obsolete\nstatus: test\ndescription: |\n    Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.\n    This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).\n    Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.\nreferences:\n    - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-05-15\nmodified: 2024-01-18\ntags:\n    - attack.credential-access\n    - attack.t1003.002\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 16\n        Provider_Name: Microsoft-Windows-Kernel-General\n        HiveName|contains:\n            - '\\Temp\\SAM'\n            - '\\Temp\\SECURITY'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.002","id":"T1003.002","name":"Security Account Manager","page":"techniques/enterprise/T1003.002/"}],"data_path":"data/detection-rules/39f919f3-980b-4e6f-a975-8af7e507ef2b.json","kind":"sigma"}