Detecting Remote Registry Abuse and Hive Dumping

Remote registry access travels over SMB to the winreg named pipe and is served by the RemoteRegistry service, which is stopped by default on modern Windows clients and starts on demand. Tools such as Impacket’s secretsdump.py and reg.py use it to read configuration, change values and save the SAM, SYSTEM and SECURITY hives for offline cracking.

Signals at a Glance

Service State and Pipe Access

On Windows 10 and Server 2019 and later, RemoteRegistry is typically disabled or manual. A remote client can still start it through a trigger, so a start event on a host where the service has never run is a strong signal. Event 7036 records the transitions; the winreg pipe appears in Event 5145 against IPC$:

// Sentinel (KQL) - RemoteRegistry started shortly after a network logon from the same source
let starts = Event
| where Source == "Service Control Manager" and EventID == 7036
| where RenderedDescription has "Remote Registry" and RenderedDescription has "running"
| project StartTime=TimeGenerated, Computer;
starts
| join kind=inner (
    SecurityEvent
    | where EventID == 4624 and LogonType == 3
    | where TargetUserName !endswith "$"
    | project LogonTime=TimeGenerated, Computer, TargetUserName, SourceIp=IpAddress
) on Computer
| where LogonTime between (StartTime - 2m .. StartTime)
| project StartTime, Computer, TargetUserName, SourceIp
// tune/validate: some management and inventory tools enable RemoteRegistry; allowlist their sources.

The network view is independent of host auditing. Suricata 7 exposes the SMB pipe name, so a pipe-name match to winreg from a workstation to a server is a direct hit:

# Suricata (validate syntax against your version; requires SMB parser enabled)
alert smb any any -> $HOME_NET 445 ( \
  msg:"HUNT SMB winreg named pipe access from non-admin source"; \
  flow:established,to_server; \
  smb.named_pipe; content:"winreg"; nocase; \
  threshold:type limit, track by_src, count 1, seconds 600; \
  classtype:policy-violation; sid:9100002; rev:1; )
# tune/validate: negate approved administration networks; combine with Zeek dce_rpc.log (winreg endpoint).

Hive Saves and Credential Access

When the goal is credential theft, the client calls the registry save operation on the SAM, SYSTEM and SECURITY hives, writes them to a temporary file in the Windows directory over the remote connection, then fetches the files over SMB and deletes them. That combination is a more specific signal than RemoteRegistry alone.

• Alert on creation of files named for or containing hive content in the Windows directory or temp paths, followed by an SMB read from the same source and a delete.
• Hunt reg.exe save HKLM\SAM, HKLM\SYSTEM and HKLM\SECURITY on the local side; the same hives saved locally are a separate, equally important rule (T1003.002).
• Keep RemoteRegistry disabled by policy on workstations and servers that do not need it, so any start is a clear anomaly.
• Treat remote registry writes to Run keys, service keys or WDigest settings as persistence or credential-exposure changes (T1112) and alert on the specific values.