T1552.002 — Credentials in Registry

Tactic: Credential Access · Platforms: Windows

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (1)

T1552.002 Unsecured Credentials: Credentials in Registry

title: "T1552.002 Unsecured Credentials: Credentials in Registry"
id: d65de9e0-368c-4a9d-bf1a-434408cc87c2
description: 'Detect Credential Discovery via Windows Registry Enumeration, retargeted to reg.exe query commands referencing password/credential keywords. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: KeywordMatch, ParentProcessFilter, TimeWindow, RegistryHiveScope.'
references:
  - https://attack.mitre.org/techniques/T1552/002
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_img:
    EventID: '1'
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'query'
  selection_keyword:
    CommandLine|contains:
      - 'password'
      - 'passw'
      - 'cred'
      - 'pwd'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_img and selection_keyword and not filter_system_account

falsepositives:
  - Administrative scripts querying the registry for password-related value names.

level: medium

Related sub-techniques

Explore