Skip to content
Threat Feed

Product

Symantec Endpoint Protection

2 briefs RSS
high advisory

Suspicious Registry Hive Access via RegBack

This rule detects attempts to access registry backup hives (SAM, SECURITY, SYSTEM) via RegBack on Windows systems, which can contain or enable access to credential material.

Endpoint Defense +6 credential-access regback windows
2r 1t
high advisory

Suspicious Process Access via Direct System Call

Detects suspicious process access events where the call trace does not originate from known Windows system DLLs, indicating potential defense evasion by bypassing hooked APIs via direct syscalls.

EdgeWebView +4 defense-evasion execution windows
2r 3t