
title: Remote Registry Management Using Reg Utility
author: Teymur Kheirkhabarov, oscd.community
date: 2019/10/22
description: Remote registry management using REG utility from non-admin workstation
detection:
  SELECTION_1:
    EventID: 5145
  SELECTION_2:
    RelativeTargetName: '*\winreg*'
  SELECTION_3:
    IpAddress: '%Admins_Workstations%'
  condition: ((SELECTION_1 and SELECTION_2) and  not (SELECTION_3))
falsepositives:
- Legitimate usage of remote registry management by administrator
id: 68fcba0d-73a5-475e-a915-e8b4c576827e
level: medium
logsource:
  product: windows
  service: security
modified: 2020/08/23
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
status: experimental
tags:
- attack.defense_evasion
- attack.t1112
- attack.discovery
- attack.t1012
- attack.credential_access
- attack.t1552.002
- attack.s0075
ruletype: SIGMA
