Windows CLI Enumeration of 3rd-Party Credential Registry Keys

title: Windows CLI Enumeration of 3rd-Party Credential Registry Keys
id: 8db0a9f0-2777-4d9f-bfe2-cfdd4e6f40ec
related:
  - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1
    type: derived
  - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40
    type: similar
  - id: 87a476dc-0079-4583-a985-dee7a20a03de
    type: derived
status: test
description: This rule flags process creation where the command line queries a set of known third-party application registry paths that can store credentials. Attackers may enumerate these locations to locate password material prior to credential access or offline collection. It relies on Windows process creation telemetry, matching command-line content against the specified registry subkey strings, while excluding a reg.exe export/save pattern.
references:
  - https://isc.sans.edu/diary/More+Data+Exfiltration/25698
  - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt
  - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password
  - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2025-05-22
tags:
  - attack.credential-access
  - attack.t1552.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - \Software\Aerofox\Foxmail\V3.1
      - \Software\Aerofox\FoxmailPreview
      - \Software\DownloadManager\Passwords
      - \Software\FTPWare\COREFTP\Sites
      - \Software\IncrediMail\Identities
      - \Software\Martin Prikryl\WinSCP 2\Sessions
      - \Software\Mobatek\MobaXterm\
      - \Software\OpenSSH\Agent\Keys
      - \Software\OpenVPN-GUI\configs
      - \Software\ORL\WinVNC3\Password
      - \Software\Qualcomm\Eudora\CommandLine
      - \Software\RealVNC\WinVNC4
      - \Software\RimArts\B2\Settings
      - \Software\SimonTatham\PuTTY\Sessions
      - \Software\SimonTatham\PuTTY\SshHostKeys\
      - \Software\Sota\FFFTP
      - \Software\TightVNC\Server
      - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin
  filter_main_other_rule:
    Image|endswith: reg.exe
    CommandLine|contains:
      - export
      - save
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1