SysKey Registry Keys Access
This rule detects attempts to access specific registry keys associated with the Windows Local Security Authority (LSA) to calculate the SysKey. SysKey is a critical encryption key used to protect sensitive system information, including password hashes. Adversaries may attempt to extract the SysKey to decrypt credentials or other sensitive data stored in the LSA, often as part of credential dumping activities. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the ObjectType is 'key' and the ObjectName ends with 'lsa\JD', 'lsa\GBG', 'lsa\Skew1', or 'lsa\Data'. These registry paths are known locations where SysKey components are stored.
Sigma
