BIOC
Low
✕
Dumping Registry hives with passwords
Dumping registry hives can be used to obtain stored credentials/hashes.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
Process action type = execution AND target process cmd = * save *HKLM\sam* , * save *HKLM\security* , * save *HKLM\system* , * save *HKEY_LOCAL_MACHINE\sam* , * save *HKEY_LOCAL_MACHINE\security* , * save *HKEY_LOCAL_MACHINE\system* Process initiated by != ir_agent.exe AND cgo name != ir_agent.exe
Preventable: yes