{"id":"T1552.002","name":"Credentials in Registry","url":"https://attack.mitre.org/techniques/T1552/002","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0250","stix_id":"x-mitre-detection-strategy--6c9e1f65-7d75-4091-b97d-e5f88ed12812","name":"Detect Credential Discovery via Windows Registry Enumeration","url":"https://attack.mitre.org/detectionstrategies/DET0250","analytics":[{"id":"AN0694","stix_id":"x-mitre-analytic--4c744ac0-ba25-4b42-8397-9b398ba55eb8","name":"Analytic 0694","description":"Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity.","url":"https://attack.mitre.org/detectionstrategies/DET0250#AN0694","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"EDR:hunting","channel":"Behavioral rule for registry enumeration under credential-related paths","data_component":"DC0050","data_component_name":"Windows Registry Key Access","log_source_slug":"edr-hunting"}],"mutable_elements":[{"field":"KeywordMatch","description":"List of strings searched in registry queries (e.g., password, credential, login). May need to expand for localized OS or app-specific terms."},{"field":"ParentProcessFilter","description":"Parent process used for registry access. Can tune for suspicious ancestry (e.g., cmd.exe > reg.exe vs. services.exe > reg.exe)."},{"field":"TimeWindow","description":"Time-based correlation window for detecting chained activity between registry reads and subsequent credential use or exfiltration."},{"field":"RegistryHiveScope","description":"HKLM vs. HKCU vs. others. May limit scope to user or system context depending on risk appetite."}],"live":true,"detection_strategies":["DET0250"],"techniques":["T1552.002"]}],"live":true,"version":"1.0","techniques":["T1552.002"]}],"sigma_rules":[{"id":"68fcba0d-73a5-475e-a915-e8b4c576827e","title":"Remote Registry Management Using Reg Utility","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2023-12-15","description":"Remote registry management using REG utility from non-admin workstation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.persistence","attack.discovery","attack.defense-impairment","attack.s0075","attack.t1012","attack.t1112","attack.t1552.002"],"path":"rules-placeholder/windows/builtin/security/win_security_remote_registry_management_via_reg.yml","techniques":["T1012","T1112","T1552.002"],"cves":[]},{"id":"87a476dc-0079-4583-a985-dee7a20a03de","title":"Enumeration for 3rd Party Creds From CLI","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2025-05-22","description":"Detects processes that query known 3rd party registry keys that holds credentials via commandline","references":["https://isc.sans.edu/diary/More+Data+Exfiltration/25698","https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt","https://github.com/HyperSine/how-does-MobaXterm-encrypt-password","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.002"],"path":"rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml","techniques":["T1552.002"],"cves":[]},{"id":"cc1abf27-78a3-4ac5-a51c-f3070b1d8e40","title":"Registry Export of Third-Party Credentials","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-05-22","modified":null,"description":"Detects the use of reg.exe to export registry paths associated with third-party credentials.\nCredential stealers have been known to use this technique to extract sensitive information from the registry.\n","references":["https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.002"],"path":"rules/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml","techniques":["T1552.002"],"cves":[]},{"id":"e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1","title":"Enumeration for Credentials in Registry","author":"frack113","status":"test","level":"medium","date":"2021-12-20","modified":"2022-12-25","description":"Adversaries may search the Registry on compromised systems for insecurely stored credentials.\nThe Windows Registry stores configuration information that can be used by the system or other programs.\nAdversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.002"],"path":"rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml","techniques":["T1552.002"],"cves":[]},{"id":"f8748f2c-89dc-4d95-afb0-5a2dfdbad332","title":"SAM Registry Hive Handle Request","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-08-12","modified":"2021-11-27","description":"Detects handles requested to SAM registry hive","references":["https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1012","attack.credential-access","attack.t1552.002"],"path":"rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml","techniques":["T1012","T1552.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}