Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0006 ✕ technique: T1003 ✕
Download CSV Show ATT&CK heatmapUncommon sensitive filesystem registry hive access Informational 4 variations
A sensitive registry hive was accessed from the filesystem by an uncommon actor, which is used for credentials dumping.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- N/A (single event)
- Deduplication:
- 1 Day
ATT&CK tactics: Credential Access (TA0006)ATT&CK techniques: OS Credential Dumping (T1003) OS Credential Dumping: Security Account Manager (T1003.002)Required data: XDR Agent with eXtended Threat Hunting (XTH)Attacker's goals: Adversary may attempt to extract credentials from the Windows Registry Credentials can then be used to perform lateral movement and access restricted information.Investigative actions: Investigate the process that tried to access the registry hive file. Investigate the actions of the user, for which his credentials were stored in the registry hive file.Variations
Uncommon filesystem registry SAM hive access by a lolbin actor in a shadow copy folder
High overridden
A sensitive registry hive was accessed from the filesystem by an uncommon actor, which is used for credentials dumping. overridden
Uncommon sensitive filesystem registry hive access by a lolbin actor in a shadow copy folder
Medium overridden
A sensitive registry hive was accessed from the filesystem by an uncommon actor, which is used for credentials dumping. overridden
Uncommon sensitive filesystem registry hive access by a rare unsigned actor in a shadow copy folder
Medium overridden
A sensitive registry hive was accessed from the filesystem by an uncommon actor, which is used for credentials dumping. overridden
Uncommon sensitive filesystem registry hive access by a rare unsigned actor
Low overridden
A sensitive registry hive was accessed from the filesystem by an uncommon actor, which is used for credentials dumping. overridden