Detection rules › Sigma
Enumeration for Credentials in Registry
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1552.002 Unsecured Credentials: Credentials in Registry |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
Stages and Predicates
Stage 1: reg
CommandLine|contains: ' query '
CommandLine|contains: '/s'
CommandLine|contains: '/t '
CommandLine|contains: REG_SZ
Image|endswith: '\reg.exe'
Stage 2: hive
or:
CommandLine|contains: '/f '
CommandLine|contains: HKCU
CommandLine|contains: '/f '
CommandLine|contains: HKLM
CommandLine|contains: 'HKCU\Software\SimonTatham\PuTTY\Sessions'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|