| ID | Name |
|---|---|
| T1552.001 | Credentials In Files |
| T1552.002 | Credentials in Registry |
| T1552.003 | Shell History |
| T1552.004 | Private Keys |
| T1552.005 | Cloud Instance Metadata API |
| T1552.006 | Group Policy Preferences |
| T1552.007 | Container API |
| T1552.008 | Chat Messages |
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information: [1]
reg query HKLM /f password /t REG_SZ /sreg query HKCU /f password /t REG_SZ /s| ID | Name | Description |
|---|---|---|
| S0331 | Agent Tesla |
Agent Tesla has the ability to extract credentials from the Registry.[2] |
| G0050 | APT32 |
APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.[3][4] |
| S1022 | IceApple |
IceApple can harvest credentials from local and remote host registries.[5] |
| S0194 | PowerSploit |
PowerSploit has several modules that search the Windows Registry for stored credentials: |
| G1039 | RedCurl |
RedCurl used LaZagne to obtain passwords in the Registry.[6][7] |
| S0075 | Reg |
Reg may be used to find credentials in the Windows Registry.[1] |
| S1183 | StrelaStealer |
StrelaStealer enumerates the registry key |
| S0266 | TrickBot |
TrickBot has retrieved PuTTY credentials by querying the |
| S0476 | Valak |
Valak can use the clientgrabber module to steal e-mail credentials from the Registry.[12] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Proactively search for credentials within the Registry and attempt to remediate the risk. |
| M1027 | Password Policies |
Do not store credentials within the Registry. |
| M1026 | Privileged Account Management |
If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0250 | Detect Credential Discovery via Windows Registry Enumeration | AN0694 |
Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity. |