Local credential registry hive saved or exported to disk

Siemphony@siemphonyhighT1003.002verified in labPlaybook · Credential theft

Matches process creation where the command line asks for a copy of one of the three hives needed to recover local account hashes offline — SAM, SYSTEM and SECURITY. Both halves are tested on CommandLine so the rule survives the usual wrappers: `reg save`, `reg.exe save`, the same command behind `cmd /c`, and the PowerShell `HKLM:\` provider form all put the verb and the hive in one string, whereas keying on Image would only catch the bare reg.exe case. MITRE's AN0235 also correlates the SAM and SYSTEM dumps a few minutes apart and watches for the resulting .save file; that TimeWindow join is not expressible in Sigma, so this fires on either hive on its own. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0085, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Local credential registry hive saved or exported to disk2id: 9f4c27b6-8e51-4a3d-b96f-0c7d2e148a353status: experimental4description: |5  Matches process creation where the command line asks for a copy of one of the6  three hives needed to recover local account hashes offline — SAM, SYSTEM and7  SECURITY. Both halves are tested on CommandLine so the rule survives the usual8  wrappers: `reg save`, `reg.exe save`, the same command behind `cmd /c`, and the9  PowerShell `HKLM:\` provider form all put the verb and the hive in one string,10  whereas keying on Image would only catch the bare reg.exe case. MITRE's AN023511  also correlates the SAM and SYSTEM dumps a few minutes apart and watches for the12  resulting .save file; that TimeWindow join is not expressible in Sigma, so this13  fires on either hive on its own.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0085, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1003/00217  - https://attack.mitre.org/detectionstrategies/DET008518author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.credential-access22  - attack.t1003.00223logsource:24  category: process_creation25  product: windows26detection:27  selection_action:28    CommandLine|contains:29      - ' save '30      - ' export '31  selection_hive:32    CommandLine|contains:33      - 'hklm\sam'34      - 'hklm\system'35      - 'hklm\security'36      - 'hklm:\sam'37      - 'hklm:\system'38      - 'hklm:\security'39      - '\registry\machine\sam'40      - '\registry\machine\security'41  # The file-copy path. The two selections above only see the registry API42  # (`reg save hklm\sam`) and miss reading the hive straight off disk, which43  # is the other half of T1003.002 and the half that avoids the registry44  # entirely: esentutl /vss, diskshadow, wbadmin and plain copy against a45  # shadow snapshot all produce a command line naming \config\SAM.46  #47  # Found by running the corpus against real telemetry — OTRF's48  # cmd_sam_copy_esentutl capture, whose single process-creation event is49  # `esentutl.exe /y /vss C:\windows/system32/config/SAM /d C:\ProgramData\SAM`.50  # The rule scored zero on it. Adversarial review had not caught this.51  #52  # Keyed on the hive's PATH rather than on the tool, so a variant using a53  # different binary against the same file still fires; keyed on \config\54  # rather than on the bare filename, because "SAM" alone appears in ordinary55  # command lines constantly.56  selection_hive_file:57    CommandLine|contains:58      - '\config\sam'59      - '\config\system'60      - '\config\security'61      - '/config/sam'62      - '/config/system'63      - '/config/security'64  condition: (selection_action and selection_hive) or selection_hive_file65falsepositives:66  - "Vendor diagnostic collectors and support scripts that run `reg export HKLM\\SYSTEM\\CurrentControlSet\\...` to capture driver or service configuration. This matches the export verb against the SYSTEM hive and is the most common benign hit; MITRE names ParentProcessName as the knob, since the collector's parent is stable and nameable."67  - "Imaging, sysprep and driver-update tooling that snapshots HKLM\\SYSTEM to a fixed path before making changes. These recur on a schedule and always write to the same location, which is what MITRE's TargetFilePath knob is for."68  - "Configuration-management and hardening runs that save a hive copy as a rollback point before applying a policy baseline. The command is indistinguishable from the adversary's on the command line alone, so suppression has to come from the account and the parent process."69  - "Legitimate SECURITY or SYSTEM hive exports during a domain-join or LSA policy troubleshooting session, typically performed interactively by an administrator from an elevated console."70level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((ProcessCommandLine contains " save " or ProcessCommandLine contains " export ") and (ProcessCommandLine contains "hklm\\sam" or ProcessCommandLine contains "hklm\\system" or ProcessCommandLine contains "hklm\\security" or ProcessCommandLine contains "hklm:\\sam" or ProcessCommandLine contains "hklm:\\system" or ProcessCommandLine contains "hklm:\\security" or ProcessCommandLine contains "\\registry\\machine\\sam" or ProcessCommandLine contains "\\registry\\machine\\security")) or (ProcessCommandLine contains "\\config\\sam" or ProcessCommandLine contains "\\config\\system" or ProcessCommandLine contains "\\config\\security" or ProcessCommandLine contains "/config/sam" or ProcessCommandLine contains "/config/system" or ProcessCommandLine contains "/config/security"))

Splunk · SPL

Run this as a search.

index=* (((CommandLine="* save *" OR CommandLine="* export *") AND (CommandLine="*hklm\\sam*" OR CommandLine="*hklm\\system*" OR CommandLine="*hklm\\security*" OR CommandLine="*hklm:\\sam*" OR CommandLine="*hklm:\\system*" OR CommandLine="*hklm:\\security*" OR CommandLine="*\\registry\\machine\\sam*" OR CommandLine="*\\registry\\machine\\security*")) OR (CommandLine="*\\config\\sam*" OR CommandLine="*\\config\\system*" OR CommandLine="*\\config\\security*" OR CommandLine="*/config/sam*" OR CommandLine="*/config/system*" OR CommandLine="*/config/security*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.command_line) LIKE "* save *" OR TO_LOWER(process.command_line) LIKE "* export *") AND (TO_LOWER(process.command_line) LIKE "*hklm\\\\sam*" OR TO_LOWER(process.command_line) LIKE "*hklm\\\\system*" OR TO_LOWER(process.command_line) LIKE "*hklm\\\\security*" OR TO_LOWER(process.command_line) LIKE "*hklm:\\\\sam*" OR TO_LOWER(process.command_line) LIKE "*hklm:\\\\system*" OR TO_LOWER(process.command_line) LIKE "*hklm:\\\\security*" OR TO_LOWER(process.command_line) LIKE "*\\\\registry\\\\machine\\\\sam*" OR TO_LOWER(process.command_line) LIKE "*\\\\registry\\\\machine\\\\security*")) OR (TO_LOWER(process.command_line) LIKE "*\\\\config\\\\sam*" OR TO_LOWER(process.command_line) LIKE "*\\\\config\\\\system*" OR TO_LOWER(process.command_line) LIKE "*\\\\config\\\\security*" OR TO_LOWER(process.command_line) LIKE "*/config/sam*" OR TO_LOWER(process.command_line) LIKE "*/config/system*" OR TO_LOWER(process.command_line) LIKE "*/config/security*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)( save | export )</field>    <field name="CommandLine" type="pcre2">(?i)(hklm\\sam|hklm\\system|hklm\\security|hklm:\\sam|hklm:\\system|hklm:\\security|\\registry\\machine\\sam|\\registry\\machine\\security)</field>    <description>Local credential registry hive saved or exported to disk (1/2)</description>    <mitre>      <id>T1003.002</id>    </mitre>  </rule>   <rule id="100001" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\\config\\sam|\\config\\system|\\config\\security|/config/sam|/config/system|/config/security)</field>    <description>Local credential registry hive saved or exported to disk (2/2)</description>    <mitre>      <id>T1003.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9f4c27b6-8e51-4a3d-b96f-0c7d2e148a35

ATT&CKT1003.002

T1003.002Security Account Manager

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — SAM hive copied out with esentutl.exe
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-backup-reg-save-hives
Backup and system-state tooling exports SAM/SYSTEM/SECURITY hives as part of a bare-metal restore point. Identical command line to credential theft.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the rule before you tune it: SAM/SECURITY save at high or critical,
Add hkey_local_machine\sam|system|security and \registry\machine\system
MITRE's ParentProcessName knob is the right suppression surface: the
MITRE's TargetFilePath knob (%TEMP%\sam.save, C:\Users\Public\*.dmp)

Declared by the author

Vendor diagnostic collectors and support scripts that run reg export HKLM\SYSTEM\CurrentControlSet\... to capture driver or service configuration. This matches the export verb against the SYSTEM hive and is the most common benign hit; MITRE names ParentProcessName as the knob, since the collector's parent is stable and nameable.
Imaging, sysprep and driver-update tooling that snapshots HKLM\SYSTEM to a fixed path before making changes. These recur on a schedule and always write to the same location, which is what MITRE's TargetFilePath knob is for.
Configuration-management and hardening runs that save a hive copy as a rollback point before applying a policy baseline. The command is indistinguishable from the adversary's on the command line alone, so suppression has to come from the account and the parent process.
Legitimate SECURITY or SYSTEM hive exports during a domain-join or LSA policy troubleshooting session, typically performed interactively by an administrator from an elevated console.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

A command line asking for a copy of one of the three registry hives needed to recover local account hashes offline: SAM, SYSTEM and SECURITY. SAM holds the hashes; SYSTEM holds the boot key that decrypts them; SECURITY holds LSA secrets. An adversary needs at least the first two, which is why MITRE's AN0235 describes correlating the SAM and SYSTEM dumps a few minutes apart. Sigma has no TimeWindow, so this rule fires on either hive on its own. Only the registry-command path is authored. AN0235 also lists Sysmon 13/14 registry access and Sysmon 11 creation of the resulting .save/.dmp file — that file-creation leg is what would catch esentutl, VSS shadow-copy dumping and secretsdump-style extraction with no reg.exe anywhere. The in-memory tools MITRE names in the technique text (Mimikatz, gsecdump, pwdumpx, secretsdump.py) are entirely out of this rule's reach.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation and
ParentProcessName (4688) / ParentImage (Sysmon 1) — not used by the rule,

03 · How the logic works

Both halves sit on `CommandLine`, not on `Image`. That is the central design choice. Image|endswith: '\reg.exe' would catch only the bare invocation; it misses a renamed copy of reg.exe, and it misses the PowerShell HKLM:\ provider form entirely, where the process is powershell.exe and the hive path is an argument. Keying both tests on the argument string means reg save, reg.exe save, the same command behind cmd /c, and the PowerShell form all land in the same selection. Note the spaces in `' save '` and `' export '`. Leading and trailing spaces are a poor man's token boundary — without them, save would match saved, autosave, and any path containing the word. The verb and the hive float free of each other. These are two unanchored substring tests over the whole command line with no adjacency requirement. The rendered Splunk confirms it: CommandLine="* save *" AND CommandLine="*hklm\\system*". A wrapped installer command that reads HKLM:\SYSTEM\CurrentControlSet somewhere and carries a standalone save token in an unrelated argument matches. A single anchored regex — roughly reg(\.exe)?\s+(save|export)\s+"?hk(lm|ey_local_machine)[\\:]+(sam|system|security)\b — would bind them. A term-list gap you can walk straight through. reg save HKEY_LOCAL_MACHINE\SAM c:\t\s.hiv is accepted verbatim by reg.exe, dumps the same hive, and matches none of the eight terms. The long hive name is simply absent. So is \registry\machine\system — the native-path branch lists SAM and SECURITY but not SYSTEM, even though SYSTEM is the hive required to decrypt the SAM.

04 · Common false positives

Vendor diagnostic collectors running reg export HKLM\SYSTEM\CurrentControlSet\...
Imaging, sysprep and driver-update tooling snapshotting HKLM\SYSTEM to a
Estate-wide management automation — SCCM/Intune remediation scripts, driver
Configuration-management runs saving a rollback copy before a policy baseline.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0085 and never executed against logs. level: high is the author's judgement, and the reviewer disputes applying it to the union.
tier_2: means running it over history, confirming the export /SYSTEM branch carries the volume, and pinning the management agents by parent.
tier_3: means adding the Sysmon 11 .save file-creation leg and MITRE's three-minute SAM→SYSTEM TimeWindow, which is where this stops being a keyword rule and starts being a detection.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/9f4c27b6-8e51-4a3d-b96f-0c7d2e148a35

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local credential registry hive saved or exported to disk

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it