SAM Registry Hive Handle Request

Title: SAM Registry Hive Handle Request
Status: test
Description:Detects handles requested to SAM registry hive
References:
  -https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
modified:2021-11-27
Tags:

• -'attack.discovery'
• -'attack.t1012'
• -'attack.credential-access'
• -'attack.t1552.002'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4656'
    ObjectType: 'Key'
    ObjectName|endswith: '\SAM'
  condition:selection
Falsepositives:
  -Unknown
Level: high