Windows Credential Access via Reg Add in LSA Registry Paths
Alerts when reg add commands target LSA registry settings and scecli entries commonly abused for credential access.
- Product
- windows
- Category
- process_creation
- Author
- Sreeman (SigmaHQ), DRL 1.1
- Published
- 2020-10-29
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the command line includes registry modification targeting the LSA configuration path and references "scecli\0*", along with the "reg add" action. Attackers may use this behavior to set up components that can impact credential handling and enable credential access. The detection relies on Windows process creation telemetry with command-line content matching the specified registry path elements.
Reporting behind it
- pentestlab.bloghttps://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/
- github.comhttps://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Credential Access via Reg Add in LSA Registry Paths
id: fb9c84bd-9242-43a1-abf4-a2efdf10b3de
status: test
description: This rule flags process creation events where the command line includes registry modification targeting the LSA configuration path and references "scecli\0*", along with the "reg add" action. Attackers may use this behavior to set up components that can impact credential handling and enable credential access. The detection relies on Windows process creation telemetry with command-line content matching the specified registry path elements.
references:
- https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/
- https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml
author: Sreeman, Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1556.002
logsource:
category: process_creation
product: windows
detection:
selection_cmdline:
CommandLine|contains|all:
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa
- scecli\0*
- reg add
condition: selection_cmdline
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b7966f4a-b333-455b-8370-8ca53c229762
type: derived