Suspicious Registry Access to SAM, SYSTEM, or SECURITY Hives

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.