Techniques
Sample rules
Registry Hive File Staged Outside Standard User Profile Path
- source: sigma
- technicques:
- t1003
- t1548
Description
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user’s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_ntuser:
TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$
filter_main_system:
TargetFilename|startswith:
- C:\Windows\System32\config\
- C:\Windows\SYSVOL\
- C:\Windows\ServiceProfiles\
filter_main_usrclass:
TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat
selection:
TargetFilename|endswith:
- \UsrClass.dat
- \NTUSER.DAT