Cross-source coverage
T1214 / ATT&CK
Credentials in Registry
ATT&CK has retired this technique. Rules still tag it; the current id is T1552.002 Unsecured Credentials: Credentials in Registry.
2 rules across 1 source.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information:
- Local Machine Hive:
reg query HKLM /f password /t REG_SZ /s - Current User Hive:
reg query HKCU /f password /t REG_SZ /s
- Tactics
- Credential Access
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| query_credentials_in_registry | Undefined | YARA-L |
| t1214__credentials_in_registry | Undefined | YARA-L |