huntrule

Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)

Flags reg.exe registry queries (REG_SZ, recursive) focused on HKLM/HKCU and PuTTY Sessions to enumerate credential material.

FreeUnreviewedSigmamediumv1
title: Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)
id: 92720b9a-61d5-4256-99ec-d0feec7cc094
status: test
description: This rule identifies process creation where reg.exe is used to query registry values of type REG_SZ and recursively search subkeys. It further narrows matches to queries that use /f targeting HKLM and HKCU and includes a specific PuTTY Sessions registry path. This matters because adversaries often enumerate insecurely stored credentials or connection data in user and machine registry hives to support credential access. Telemetry relies on Windows process creation logging with the executable path and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml
author: frack113, Huntrule Team
date: 2021-12-20
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1552.002
logsource:
  category: process_creation
  product: windows
detection:
  reg:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
      - " query "
      - "/t "
      - REG_SZ
      - /s
  hive:
    - CommandLine|contains|all:
        - "/f "
        - HKLM
    - CommandLine|contains|all:
        - "/f "
        - HKCU
    - CommandLine|contains: HKCU\Software\SimonTatham\PuTTY\Sessions
  condition: reg and hive
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1
    type: derived

What it detects

This rule identifies process creation where reg.exe is used to query registry values of type REG_SZ and recursively search subkeys. It further narrows matches to queries that use /f targeting HKLM and HKCU and includes a specific PuTTY Sessions registry path. This matters because adversaries often enumerate insecurely stored credentials or connection data in user and machine registry hives to support credential access. Telemetry relies on Windows process creation logging with the executable path and full command line.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.