Windows Credential Access via Reg Add in LSA Registry Paths

title: Windows Credential Access via Reg Add in LSA Registry Paths
id: fb9c84bd-9242-43a1-abf4-a2efdf10b3de
status: test
description: This rule flags process creation events where the command line includes registry modification targeting the LSA configuration path and references "scecli\0*", along with the "reg add" action. Attackers may use this behavior to set up components that can impact credential handling and enable credential access. The detection relies on Windows process creation telemetry with command-line content matching the specified registry path elements.
references:
  - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/
  - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml
author: Sreeman, Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdline:
    CommandLine|contains|all:
      - HKLM\SYSTEM\CurrentControlSet\Control\Lsa
      - scecli\0*
      - reg add
  condition: selection_cmdline
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b7966f4a-b333-455b-8370-8ca53c229762
    type: derived