{"id":"e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1","title":"Enumeration for Credentials in Registry","description":"Adversaries may search the Registry on compromised systems for insecurely stored credentials.\nThe Windows Registry stores configuration information that can be used by the system or other programs.\nAdversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services\n","author":"frack113","status":"test","level":"medium","date":"2021-12-20","modified":"2022-12-25","tags":["attack.credential-access","attack.t1552.002"],"technique_ids":["T1552.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml","source_sha256":"9cc31e73f01e1a04ef1a2a0c8201669ab32b22ae6895dc5e47c574a48d0d8c18","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Enumeration for Credentials in Registry\nid: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1\nstatus: test\ndescription: |\n    Adversaries may search the Registry on compromised systems for insecurely stored credentials.\n    The Windows Registry stores configuration information that can be used by the system or other programs.\n    Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md\nauthor: frack113\ndate: 2021-12-20\nmodified: 2022-12-25\ntags:\n    - attack.credential-access\n    - attack.t1552.002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    reg:\n        Image|endswith: '\\reg.exe'\n        CommandLine|contains|all:\n            - ' query '\n            - '/t '\n            - 'REG_SZ'\n            - '/s'\n    hive:\n        - CommandLine|contains|all:\n              - '/f '\n              - 'HKLM'\n        - CommandLine|contains|all:\n              - '/f '\n              - 'HKCU'\n        - CommandLine|contains: 'HKCU\\Software\\SimonTatham\\PuTTY\\Sessions'\n    condition: reg and hive\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.002","id":"T1552.002","name":"Credentials in Registry","page":"techniques/enterprise/T1552.002/"}],"data_path":"data/detection-rules/e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1.json","kind":"sigma"}