Windows Process Creation: Pypykatz Credential Dumping via Registry Parsing
Alerts when pypykatz is run with "live" and "registry" parameters to extract credential data from local SAM-related artifacts.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-05
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where pypykatz is executed or a Python interpreter launches pypykatz, with command-line arguments indicating live registry parsing. Attackers use pypykatz to extract stored credential material by targeting the Security Account Manager (SAM) information exposed through Windows registry data. The detection relies on process creation telemetry, specifically the executable path/name and command-line content containing both the terms "live" and "registry".
Reporting behind it
- github.comhttps://github.com/skelsec/pypykatz
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Pypykatz Credential Dumping via Registry Parsing"
id: c9cf30b1-8aa5-4098-8899-491b105bd4c4
status: test
description: This rule flags Windows process creation events where pypykatz is executed or a Python interpreter launches pypykatz, with command-line arguments indicating live registry parsing. Attackers use pypykatz to extract stored credential material by targeting the Security Account Manager (SAM) information exposed through Windows registry data. The detection relies on process creation telemetry, specifically the executable path/name and command-line content containing both the terms "live" and "registry".
references:
- https://github.com/skelsec/pypykatz
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml
author: frack113, Huntrule Team
date: 2022-01-05
modified: 2023-02-05
tags:
- attack.credential-access
- attack.t1003.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \pypykatz.exe
- \python.exe
CommandLine|contains|all:
- live
- registry
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a29808fd-ef50-49ff-9c7a-59a9b040b404
type: derived