Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1003 ✕

Download CSV Show ATT&CK heatmap
  • Uncommon sensitive registry hive dump Low 4 variations

    A sensitive registry hive was extracted, which is used for accessing credentials.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Required data: XDR Agent with eXtended Threat Hunting (XTH)
    Attacker's goals: Adversary may attempt to extract credentials from the Windows Registry Credentials can then be used to perform lateral movement and access restricted information.
    Investigative actions: Investigate the process that tried to access the registry hive. Investigate the actions of the user for which his credentials were stored in the registry hive.

    Variations

    Uncommon sensitive registry hive dump by unsigned and rare process

    High overridden

    A sensitive registry hive was extracted, which is used for accessing credentials. overridden

    Uncommon sensitive registry hive dump by injected process

    High overridden

    A sensitive registry hive was extracted, which is used for accessing credentials. overridden

    Uncommon sensitive registry hive dump by reg.exe lolbin process which was executed by rare causality process

    High overridden

    A sensitive registry hive was extracted, which is used for accessing credentials. overridden

    Uncommon sensitive registry hive dump by reg.exe lolbin process

    Medium overridden

    A sensitive registry hive was extracted, which is used for accessing credentials. overridden