huntrule

Windows reg.exe Registry Save/Export of Third-Party Credential Paths

Alerts on reg.exe save/export commands targeting registry keys tied to third-party credential data.

FreeUnreviewedSigmahighv1
title: Windows reg.exe Registry Save/Export of Third-Party Credential Paths
id: 0b534e75-6089-4e95-a130-0bdb2302a54e
related:
  - id: 87a476dc-0079-4583-a985-dee7a20a03de
    type: similar
  - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40
    type: derived
status: experimental
description: This rule flags process executions of reg.exe where the command line includes both registry save/export indicators and targets specific third-party application registry paths associated with credentials. Attackers can use reg.exe to extract sensitive configuration data directly from the registry for credential access. The detection relies on Windows process creation telemetry, matching the reg.exe binary and inspecting the command line for save/export terms and known registry subkey paths.
references:
  - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.credential-access
  - attack.t1552.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli_save:
    CommandLine|contains:
      - save
      - export
  selection_cli_path:
    CommandLine|contains:
      - \Software\Aerofox\Foxmail\V3.1
      - \Software\Aerofox\FoxmailPreview
      - \Software\DownloadManager\Passwords
      - \Software\FTPWare\COREFTP\Sites
      - \Software\IncrediMail\Identities
      - \Software\Martin Prikryl\WinSCP 2\Sessions
      - \Software\Mobatek\MobaXterm
      - \Software\OpenSSH\Agent\Keys
      - \Software\OpenVPN-GUI\configs
      - \Software\ORL\WinVNC3\Password
      - \Software\Qualcomm\Eudora\CommandLine
      - \Software\RealVNC\WinVNC4
      - \Software\RimArts\B2\Settings
      - \Software\SimonTatham\PuTTY\Sessions
      - \Software\SimonTatham\PuTTY\SshHostKeys
      - \Software\Sota\FFFTP
      - \Software\TightVNC\Server
      - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process executions of reg.exe where the command line includes both registry save/export indicators and targets specific third-party application registry paths associated with credentials. Attackers can use reg.exe to extract sensitive configuration data directly from the registry for credential access. The detection relies on Windows process creation telemetry, matching the reg.exe binary and inspecting the command line for save/export terms and known registry subkey paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.