{"id":"87a476dc-0079-4583-a985-dee7a20a03de","title":"Enumeration for 3rd Party Creds From CLI","description":"Detects processes that query known 3rd party registry keys that holds credentials via commandline","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2025-05-22","tags":["attack.credential-access","attack.t1552.002"],"technique_ids":["T1552.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://isc.sans.edu/diary/More+Data+Exfiltration/25698","https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt","https://github.com/HyperSine/how-does-MobaXterm-encrypt-password","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry"],"source_path":"rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml","source_sha256":"89b1fe5201771ebda9e0e95561e4d552a67bcd8adf9e92b062ff2373b281afdf","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Enumeration for 3rd Party Creds From CLI\nid: 87a476dc-0079-4583-a985-dee7a20a03de\nrelated:\n    - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1\n      type: derived\n    - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40\n      type: similar\nstatus: test\ndescription: Detects processes that query known 3rd party registry keys that holds credentials via commandline\nreferences:\n    - https://isc.sans.edu/diary/More+Data+Exfiltration/25698\n    - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt\n    - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password\n    - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-20\nmodified: 2025-05-22\ntags:\n    - attack.credential-access\n    - attack.t1552.002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: # Add more paths as they are discovered\n            - '\\Software\\Aerofox\\Foxmail\\V3.1'\n            - '\\Software\\Aerofox\\FoxmailPreview'\n            - '\\Software\\DownloadManager\\Passwords'\n            - '\\Software\\FTPWare\\COREFTP\\Sites'\n            - '\\Software\\IncrediMail\\Identities'\n            - '\\Software\\Martin Prikryl\\WinSCP 2\\Sessions'\n            - '\\Software\\Mobatek\\MobaXterm\\'\n            - '\\Software\\OpenSSH\\Agent\\Keys'\n            - '\\Software\\OpenVPN-GUI\\configs'\n            - '\\Software\\ORL\\WinVNC3\\Password'\n            - '\\Software\\Qualcomm\\Eudora\\CommandLine'\n            - '\\Software\\RealVNC\\WinVNC4'\n            - '\\Software\\RimArts\\B2\\Settings'\n            - '\\Software\\SimonTatham\\PuTTY\\Sessions'\n            - '\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\'\n            - '\\Software\\Sota\\FFFTP'\n            - '\\Software\\TightVNC\\Server'\n            - '\\Software\\WOW6432Node\\Radmin\\v3.0\\Server\\Parameters\\Radmin'\n    filter_main_other_rule:  # matched by cc1abf27-78a3-4ac5-a51c-f3070b1d8e40\n        Image|endswith: 'reg.exe'\n        CommandLine|contains:\n            - 'export'\n            - 'save'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.002","id":"T1552.002","name":"Credentials in Registry","page":"techniques/enterprise/T1552.002/"}],"data_path":"data/detection-rules/87a476dc-0079-4583-a985-dee7a20a03de.json","kind":"sigma"}