Critical Hive In Suspicious Location Access Bits Cleared
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
Sigma
