Enumeration for 3rd Party Creds From CLI — Detection Rule

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read the full analysis on IntelFusions