Analytics BIOC Low
✕

Unprivileged process opened a registry hive

An unprivileged process opened a registry hive directly.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
Attacker's goals:

An attacker may attempt to gain higher privileges.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.

Test period:
N/A (single event)
Deduplication:
1 Day