SysKey Registry Keys Access

Title: SysKey Registry Keys Access
Status: test
Description:Detects handle requests and access operations to specific registry keys to calculate the SysKey
References:
  -https://threathunterplaybook.com/hunts/windows/190625-RegKeyAccessSyskey/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
modified:2021-11-27
Tags:

• -'attack.discovery'
• -'attack.t1012'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'4656'
      -'4663'

    ObjectType: 'key'
    ObjectName|endswith:
      -'lsa\JD'
      -'lsa\GBG'
      -'lsa\Skew1'
      -'lsa\Data'

  condition:selection
Falsepositives:
  -Unknown
Level: high