From 8a9fb3a7ed17b63c01d78de1396bfc84d8b5a0c3 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 15 Jul 2026 01:32:08 +0200 Subject: [PATCH] refactor(rules): Improve Registry access to SAM database rule --- ...credential_access_registry_access_to_sam_database.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/rules/credential_access_registry_access_to_sam_database.yml b/rules/credential_access_registry_access_to_sam_database.yml index 9b23fec41..41b5198a6 100644 --- a/rules/credential_access_registry_access_to_sam_database.yml +++ b/rules/credential_access_registry_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: Registry access to SAM database id: 2f326557-0291-4eb1-a87a-7a17b7d941cb -version: 2.0.2 +version: 2.0.3 description: Identifies access to the Security Account Manager registry hives. labels: @@ -21,14 +21,13 @@ condition: > maxspan 10m by ps.uuid |spawn_process and - not (ps.parent.exe imatches + ps.parent.exe not imatches ( '?:\\Program Files\\*.exe', '?:\\Program Files (x86)\\*.exe', '?:\\Windows\\System32\\svchost.exe' - ) - ) and - not (ps.cmdline imatches '"?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior') and + ) and + not (ps.exe imatches '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe' and ps.cmdline icontains 'ExecuteQueuedItems /LegacyServiceBehavior') and not (ps.exe imatches '?:\\WINDOWS\\system32\\wevtutil.exe' and ps.parent.exe imatches '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe') | |open_registry and