T1552.002 Credentials in Registry — ATT&CK Technique
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: * Local Machine Hive: reg query HKLM /f password /t REG_SZ /s * Current User Hive: reg query HKCU /f password /t REG_SZ /s
Detection coverage (8)
- Remote Registry Management Using Reg Utility medium
- Enumeration for Credentials in Registry medium
- SAM Registry Hive Handle Request high
- Registry Export of Third-Party Credentials high
- Enumeration for 3rd Party Creds From CLI medium
- Add DefaultUser And Password In Registry
- Auto Admin Logon Registry Entry
- Windows Credentials in Registry Reg Query