Rules Contributing to Suspicious Handle Request to Sensitive Object Alerts

The following rules are used to identify suspicious activity with handle requests to sensitive Windows objects. Any one or more of these will trigger a Suspicious Handle Request to Sensitive Object Alert. Details for each rule can be viewed by clicking the More Details link in the description.
Title |
Description |
||||||||
---|---|---|---|---|---|---|---|---|---|
SAM Registry Hive Handle Request |
Detects handles requested to SAM registry hive More details
![]() Rule IDQuery{'selection': {'EventID': 4656, 'ObjectType': 'Key', 'ObjectName|endswith': '\\SAM'}, 'condition': 'selection'} Log SourceStellar Cyber Windows Server Sensor configured for:
Rule SourceSigmaHQ,f8748f2c-89dc-4d95-afb0-5a2dfdbad332 Author: Roberto Rodriguez @Cyb3rWard0g Tactics, Techniques, and ProceduresTA0007, T1012, TA0006, T1552.002 ReferencesSeverity75 Suppression Logic Based On
Additional Information
|