Detect Attempts To Modify Amcachehve Or SYSTEM File
Query
DeviceFileEvents
| where (FileName contains "SYSTEM" and FolderPath contains "C:\\Windows\\System32\\config\\") or (FileName has "Amcache.hve")
| project Timestamp, DeviceName,DeviceId, FileName, FolderPath, ActionType, InitiatingProcessFileName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1070 | Indicator Removal |
Author: Sergio Albea (05/06/2026)
Detect Attempts to modify Amcache.hve or SYSTEM files
Description: Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
That’s why it’s critical to monitor for these kinds of actions in Defender XDR or Microsoft Sentinel environments using KQL.
Explanation
This query is designed to detect suspicious activities related to the modification or deletion of specific Windows registry files, which could indicate an attempt to cover up malicious actions on a system. Here's a simple breakdown:
-
Purpose: The query aims to identify any attempts to alter or delete the
Amcache.hvefile or theSYSTEMfiles located in theC:\Windows\System32\config\directory. These files are crucial for forensic investigations as they log details about executed programs and system activities. -
Why It Matters: Attackers might try to modify or delete these files to erase evidence of their activities, making it harder for investigators to track what happened on the system.
-
How It Works:
- The query looks at
DeviceFileEvents, which logs file-related activities on devices. - It filters events where the file name is either
Amcache.hveor containsSYSTEMand is located in the specified directory. - It then selects and displays relevant details such as the timestamp of the event, device name, file name, folder path, type of action taken, the process that initiated the action, and a report ID.
- The query looks at
-
Usage: This query can be run in Microsoft Defender XDR or Microsoft Sentinel environments using KQL (Kusto Query Language) to monitor and alert security teams about potential tampering with these critical files.
