Cross-source coverage
T1552.002 / ATT&CK
Unsecured Credentials: Credentials in Registry
8 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information:
- Local Machine Hive:
reg query HKLM /f password /t REG_SZ /s - Current User Hive:
reg query HKCU /f password /t REG_SZ /s
- Tactics
- Credential Access
- Platforms
- Windows
- Telemetry
-
WinEventLog:SysmonEDR:hunting
How MITRE says to detect it DET0250
Detect Credential Discovery via Windows Registry Enumeration
Windows Analytic 0694
Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=13, 14EDR:huntingBehavioral rule for registry enumeration under credential-related paths
SigmaHQ/sigma
5 rules| Detection | Severity | Format |
|---|---|---|
| Registry Export of Third-Party Credentials | High | Sigma |
| SAM Registry Hive Handle Request | High | Sigma |
| Enumeration for 3rd Party Creds From CLI | Medium | Sigma |
| Enumeration for Credentials in Registry | Medium | Sigma |
| Remote Registry Management Using Reg Utility | Medium | Sigma |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Add DefaultUser And Password In Registry | Undefined | SPL |
| Auto Admin Logon Registry Entry | Undefined | SPL |
| Windows Credentials in Registry Reg Query | Undefined | SPL |