huntrule

Windows reg.exe Registry Save/Export of Third-Party Credential Paths

Alerts on reg.exe save/export commands targeting registry keys tied to third-party credential data.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-05-22
Updated
2026-07-30
AnalysisDetection
title: Windows reg.exe Registry Save/Export of Third-Party Credential Paths
id: 0b534e75-6089-4e95-a130-0bdb2302a54e
related:
  - id: 87a476dc-0079-4583-a985-dee7a20a03de
    type: similar
  - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40
    type: derived
status: experimental
description: This rule flags process executions of reg.exe where the command line includes both registry save/export indicators and targets specific third-party application registry paths associated with credentials. Attackers can use reg.exe to extract sensitive configuration data directly from the registry for credential access. The detection relies on Windows process creation telemetry, matching the reg.exe binary and inspecting the command line for save/export terms and known registry subkey paths.
references:
  - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.credential-access
  - attack.t1552.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli_save:
    CommandLine|contains:
      - save
      - export
  selection_cli_path:
    CommandLine|contains:
      - \Software\Aerofox\Foxmail\V3.1
      - \Software\Aerofox\FoxmailPreview
      - \Software\DownloadManager\Passwords
      - \Software\FTPWare\COREFTP\Sites
      - \Software\IncrediMail\Identities
      - \Software\Martin Prikryl\WinSCP 2\Sessions
      - \Software\Mobatek\MobaXterm
      - \Software\OpenSSH\Agent\Keys
      - \Software\OpenVPN-GUI\configs
      - \Software\ORL\WinVNC3\Password
      - \Software\Qualcomm\Eudora\CommandLine
      - \Software\RealVNC\WinVNC4
      - \Software\RimArts\B2\Settings
      - \Software\SimonTatham\PuTTY\Sessions
      - \Software\SimonTatham\PuTTY\SshHostKeys
      - \Software\Sota\FFFTP
      - \Software\TightVNC\Server
      - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1