Detectionhighexperimental

Registry Hive File Staged Outside Standard User Profile Path

Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user's profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Thu Jul 23a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith:
            - '\UsrClass.dat'
            - '\NTUSER.DAT'
    filter_main_usrclass:
        TargetFilename|endswith: '\AppData\Local\Microsoft\Windows\UsrClass.dat'
    filter_main_ntuser:
        TargetFilename|re|i: '^C:\\Users\\[^\\]+\\NTUSER\.DAT$'
    filter_main_system:
        TargetFilename|startswith:
            - 'C:\Windows\System32\config\'
            - 'C:\Windows\SYSVOL\'
            - 'C:\Windows\ServiceProfiles\'
    condition: selection and not 1 of filter_main_*