Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)
Flags reg.exe registry queries (REG_SZ, recursive) focused on HKLM/HKCU and PuTTY Sessions to enumerate credential material.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-20
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where reg.exe is used to query registry values of type REG_SZ and recursively search subkeys. It further narrows matches to queries that use /f targeting HKLM and HKCU and includes a specific PuTTY Sessions registry path. This matters because adversaries often enumerate insecurely stored credentials or connection data in user and machine registry hives to support credential access. Telemetry relies on Windows process creation logging with the executable path and full command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)
id: 92720b9a-61d5-4256-99ec-d0feec7cc094
status: test
description: This rule identifies process creation where reg.exe is used to query registry values of type REG_SZ and recursively search subkeys. It further narrows matches to queries that use /f targeting HKLM and HKCU and includes a specific PuTTY Sessions registry path. This matters because adversaries often enumerate insecurely stored credentials or connection data in user and machine registry hives to support credential access. Telemetry relies on Windows process creation logging with the executable path and full command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml
author: frack113, Huntrule Team
date: 2021-12-20
modified: 2022-12-25
tags:
- attack.credential-access
- attack.t1552.002
logsource:
category: process_creation
product: windows
detection:
reg:
Image|endswith: \reg.exe
CommandLine|contains|all:
- " query "
- "/t "
- REG_SZ
- /s
hive:
- CommandLine|contains|all:
- "/f "
- HKLM
- CommandLine|contains|all:
- "/f "
- HKCU
- CommandLine|contains: HKCU\Software\SimonTatham\PuTTY\Sessions
condition: reg and hive
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1
type: derived