Detectionhightest
SysKey Registry Keys Access
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Roberto Rodriguez (Cyb3rWard0g)Created Mon Aug 12Updated Sat Nov 279a4ff3b8-6187-4fd2-8e8b-e0eae1129495windows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic1 selector
detection:
selection:
EventID:
- 4656
- 4663
ObjectType: 'key'
ObjectName|endswith:
- 'lsa\JD'
- 'lsa\GBG'
- 'lsa\Skew1'
- 'lsa\Data'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
9a4ff3b8-6187-4fd2-8e8b-e0eae1129495
Status
test
Level
high
Type
Detection
Created
Mon Aug 12
Modified
Sat Nov 27
Path
rules/windows/builtin/security/win_security_syskey_registry_access.yml
Raw Tags
attack.discoveryattack.t1012