Detect exporting SAM from registry

This Expert rule detects when unauthorized users/applications access Windows registry to export the Security Account Manager (SAM) database file.

Note

Exploit Prevention is not supported in the ARM architecture.

Important

Make sure to test this Expert rule on a client system before enforcing wider.

Rule {
    Process {
        Include AggregateMatch -xtype "1" {
            Exclude VTP_PRIVILEGES -type BITMASK { -v 0x8 }
        }
        Include AggregateMatch -xtype "2" {
            Exclude OBJECT_NAME { -v "TIWORKER.EXE" }
            Exclude OBJECT_NAME { -v "DEVICECENSUS.EXE" }
            Exclude OBJECT_NAME { -v "TRUSTEDINSTALLER.EXE" }
            Exclude OBJECT_NAME { -v "TASKHOSTW.EXE" }
            Exclude OBJECT_NAME { -v "OMADMCLIENT.EXE" }
            Exclude OBJECT_NAME { -v "SERVICES.EXE" }
            Exclude OBJECT_NAME { -v "CSRSS.EXE" }
            Exclude OBJECT_NAME { -v "SVCHOST.EXE" }
            Exclude OBJECT_NAME { -v "WINLOGON.EXE" }
            Exclude OBJECT_NAME { -v "SCHTASKS.EXE" }
            Exclude OBJECT_NAME { -v "REGEDIT.EXE" }
            Exclude OBJECT_NAME { -v "UpdateNotificationMgr.exe" }
            Exclude OBJECT_NAME { -v "**\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.exe" }
            Exclude OBJECT_NAME { -v "**\\Program Files (x86)\\Common Files\\microsoft shared\\ClickToRun\\*.exe" }
            Exclude OBJECT_NAME { -v "**\\program files\\microsoft office\\**.exe" }
            Exclude OBJECT_NAME { -v "**\\program files (x86)\\microsoft office\\**.exe" }
            }
      }
      Target {
          Match KEY {
Include OBJECT_NAME { -v "HKLM\\SAM" }
Include OBJECT_NAME { -v "HKLM\\SAM\\Domain\\Account" }
Include OBJECT_NAME { -v "HKLM\\SECURITY\\Policy\\Secrets"}
Include -access "READ"
}
}
}

For more Expert Rules examples, visit the Trellix Github repository.