title: Grabbing Sensitive Hives via Reg Utility
id: fd877b94-9bb5-4191-bb25-d79cbd93c167
status: test
description: Dump sam, system or security hives using REG.exe utility
author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md
  - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
date: 2019/10/22
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - 'save'
      - 'export'
      - 'ˢave'
      - 'eˣport'
  selection_2:
    CommandLine|contains:
      - 'hklm'
      - 'hk˪m'
      - 'hkey_local_machine'
      - 'hkey_˪ocal_machine'
      - 'hkey_loca˪_machine'
      - 'hkey_˪oca˪_machine'
  selection_3:
    CommandLine|endswith:
      - '\system'
      - '\sam'
      - '\security'
      - '\ˢystem'
      - '\syˢtem'
      - '\ˢyˢtem'
      - '\ˢam'
      - '\ˢecurity'
  condition: selection_1 and selection_2 and selection_3
falsepositives:
  - Dumping hives for legitimate purpouse i.e. backup or forensic investigation
level: medium
tags:
  - attack.credential_access
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.005
  - car.2013-07-001
