LoFP LoFP / t1003.002

t1003.002

TitleTags
administrators may legitimately assign the privileged authentication administrator role as part of administrative tasks. filter as needed.
av signature updates
copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic invetigator
dumping hives for legitimate purpouse i.e. backup or forensic investigation
false positives should be limited, but if any are present, filter as needed.
false positives should be limited, but if any are present, filter as needed. in some instances, `cscript.exe` is used for legitimate business practices.
false positives should be limited. filter as needed.
files with mimikatz in their filename
it is possible some agent based products will generate false positives. filter as needed.
legitimate administrator using credential dumping tool for password recovery
legitimate administrator using tool for password recovery
legitimate administrator working with shadow copies, access for backup purposes
legitimate use of volume shadow copy mounts (backups maybe).
legitimate use of vssvc. maybe backup operations. it would usually be done by c:\windows\system32\vssvc.exe.
limited false positives as the scope is limited to sam, system and security hives.
natively, `dllhost.exe` will access the files. every environment will have additional native processes that do as well. filter by process_name. as an aside, one can remove process_name entirely and add `object_name=*shadowcopy*`.
naughty administrators
powershell scripts fixing hivenightmare / serioussam acls
privileged graph api permissions may be assigned for legitimate purposes. filter as needed.
rare cases of administrative activity
some rare backup scenarios
transferring sensitive files for legitimate administration work by legitimate administrator
unlikely
vulnerability scanners or system administration tools may also trigger this detection. filter as needed.