Windows reg.exe Registry Save/Export of Third-Party Credential Paths
Alerts on reg.exe save/export commands targeting registry keys tied to third-party credential data.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of reg.exe where the command line includes both registry save/export indicators and targets specific third-party application registry paths associated with credentials. Attackers can use reg.exe to extract sensitive configuration data directly from the registry for credential access. The detection relies on Windows process creation telemetry, matching the reg.exe binary and inspecting the command line for save/export terms and known registry subkey paths.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows reg.exe Registry Save/Export of Third-Party Credential Paths
id: 0b534e75-6089-4e95-a130-0bdb2302a54e
related:
- id: 87a476dc-0079-4583-a985-dee7a20a03de
type: similar
- id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40
type: derived
status: experimental
description: This rule flags process executions of reg.exe where the command line includes both registry save/export indicators and targets specific third-party application registry paths associated with credentials. Attackers can use reg.exe to extract sensitive configuration data directly from the registry for credential access. The detection relies on Windows process creation telemetry, matching the reg.exe binary and inspecting the command line for save/export terms and known registry subkey paths.
references:
- https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
- attack.credential-access
- attack.t1552.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_cli_save:
CommandLine|contains:
- save
- export
selection_cli_path:
CommandLine|contains:
- \Software\Aerofox\Foxmail\V3.1
- \Software\Aerofox\FoxmailPreview
- \Software\DownloadManager\Passwords
- \Software\FTPWare\COREFTP\Sites
- \Software\IncrediMail\Identities
- \Software\Martin Prikryl\WinSCP 2\Sessions
- \Software\Mobatek\MobaXterm
- \Software\OpenSSH\Agent\Keys
- \Software\OpenVPN-GUI\configs
- \Software\ORL\WinVNC3\Password
- \Software\Qualcomm\Eudora\CommandLine
- \Software\RealVNC\WinVNC4
- \Software\RimArts\B2\Settings
- \Software\SimonTatham\PuTTY\Sessions
- \Software\SimonTatham\PuTTY\SshHostKeys
- \Software\Sota\FFFTP
- \Software\TightVNC\Server
- \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1