Detect Attempts To Modify Amcachehve Or SYSTEM File
Query
DeviceFileEvents
| where (FileName contains "SYSTEM" and FolderPath contains "C:\\Windows\\System32\\config\\") or (FileName has "Amcache.hve")
| project Timestamp, DeviceName,DeviceId, FileName, FolderPath, ActionType, InitiatingProcessFileName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1070 | Indicator Removal |
Author: Sergio Albea (29/07/2025)
Detect Attempts to modify Amcache.hve or SYSTEM files
Description: Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
That’s why it’s critical to monitor for these kinds of actions in Defender XDR or Microsoft Sentinel environments using KQL.
Explanation
The query is designed to detect attempts to modify or tamper with specific Windows registry files, namely Amcache.hve and SYSTEM, which are crucial for forensic investigations. Here's a simplified breakdown:
-
Purpose: The query aims to identify suspicious activities that involve altering or deleting the
Amcache.hvefile or theSYSTEMregistry file. These files are important for tracking program execution history on a Windows system. -
Why It Matters: Attackers might try to modify or delete these files to hide evidence of their activities, making it harder for investigators to trace what programs were executed on the system.
-
How It Works:
- The query searches for file events related to
Amcache.hveor files namedSYSTEMlocated in theC:\Windows\System32\config\directory. - It filters these events from the
DeviceFileEventsdata source. - The query then extracts and displays relevant information such as the timestamp of the event, the device name and ID, the file name and path, the type of action performed, the name of the process that initiated the action, and a report ID.
- The query searches for file events related to
-
Usage: This query can be run in security monitoring tools like Microsoft Defender XDR or Microsoft Sentinel to alert security teams about potential attempts to cover up malicious activities by tampering with these registry files.
