title: Grabbing Sensitive Hives via Reg Utility
id: fd877b94-9bb5-4191-bb25-d79cbd93c167
description: Dump sam, system or security hives using REG.exe utility
author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community
date: 2019/10/22
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md
tags:
    - attack.credential_access
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.005
    - attack.t1003  # an old one
    - car.2013-07-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        Image: '*\reg.exe'
        CommandLine|contains:
            - 'save'
            - 'export'
    selection_2:
        CommandLine|contains:
            - 'hklm'
            - 'hkey_local_machine'
    selection_3:
        CommandLine|endswith:
            - '\system'
            - '\sam'
            - '\security'
    condition: selection_1 and selection_2 and selection_3
falsepositives:
    - Dumping hives for legitimate purpouse i.e. backup or forensic investigation
level: medium
status: experimental
