name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 1
date: 2020-6-04
author: Jose Hernandez, Splunk
type: streaming
datamodel: []
description: Monitor for execution of reg.exe with parameters specifying an export
  of keys that contain hashed credentials that attackers may try to crack offline.
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
  "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
  "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
  "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
  | where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null  AND
  match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true
  OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true
  OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
  /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
  ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
  dest_user_id), body = "TBD" | into write_ssa_detected_events(); '
how_to_implement: You must be ingesting windows endpoint data that tracks process
  activity, including parent-child relationships from your endpoints.
known_false_positives: None identified.
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003
  nist:
  - DE.CM
  product:
  - UEBA for Security Cloud
  required_fields:
  - process_name
  - _time
  - dest_device_id
  - dest_user_id
  - process
  risk_severity: low
  security_domain: endpoint
