Windows CLI Enumeration of 3rd-Party Credential Registry Keys
Alerts when Windows processes use command-line queries to enumerate credential-containing third-party registry keys.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-20
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where the command line queries a set of known third-party application registry paths that can store credentials. Attackers may enumerate these locations to locate password material prior to credential access or offline collection. It relies on Windows process creation telemetry, matching command-line content against the specified registry subkey strings, while excluding a reg.exe export/save pattern.
Reporting behind it
- isc.sans.eduhttps://isc.sans.edu/diary/More+Data+Exfiltration/25698
- github.comhttps://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt
- github.comhttps://github.com/HyperSine/how-does-MobaXterm-encrypt-password
- book.hacktricks.xyzhttps://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CLI Enumeration of 3rd-Party Credential Registry Keys
id: 8db0a9f0-2777-4d9f-bfe2-cfdd4e6f40ec
related:
- id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1
type: derived
- id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40
type: similar
- id: 87a476dc-0079-4583-a985-dee7a20a03de
type: derived
status: test
description: This rule flags process creation where the command line queries a set of known third-party application registry paths that can store credentials. Attackers may enumerate these locations to locate password material prior to credential access or offline collection. It relies on Windows process creation telemetry, matching command-line content against the specified registry subkey strings, while excluding a reg.exe export/save pattern.
references:
- https://isc.sans.edu/diary/More+Data+Exfiltration/25698
- https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt
- https://github.com/HyperSine/how-does-MobaXterm-encrypt-password
- https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2025-05-22
tags:
- attack.credential-access
- attack.t1552.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- \Software\Aerofox\Foxmail\V3.1
- \Software\Aerofox\FoxmailPreview
- \Software\DownloadManager\Passwords
- \Software\FTPWare\COREFTP\Sites
- \Software\IncrediMail\Identities
- \Software\Martin Prikryl\WinSCP 2\Sessions
- \Software\Mobatek\MobaXterm\
- \Software\OpenSSH\Agent\Keys
- \Software\OpenVPN-GUI\configs
- \Software\ORL\WinVNC3\Password
- \Software\Qualcomm\Eudora\CommandLine
- \Software\RealVNC\WinVNC4
- \Software\RimArts\B2\Settings
- \Software\SimonTatham\PuTTY\Sessions
- \Software\SimonTatham\PuTTY\SshHostKeys\
- \Software\Sota\FFFTP
- \Software\TightVNC\Server
- \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin
filter_main_other_rule:
Image|endswith: reg.exe
CommandLine|contains:
- export
- save
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1