tfMITRE ATT&CK sub-technique

Credentials in Registry T1552.002

sub-technique of T1552 Unsecured Credentials

Tactic: Credential Access
Platform: Windows
Version: 1.2
Created: 04 February 2020
Last modified: 12 May 2026
Contributor: Sudhanshu Chauhan, @Sudhanshu_C

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Credentials in Registry MITRE reference T1552.002

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Had exported credentials from registry hives to include those stored in HKLM.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

RedCurlG1039 ↗

Used LaZagne to obtain passwords in the Registry.1 2

created 2024-09-232 references

APT32G0050 ↗

Used Outlook Credential Dumper to harvest credentials stored in Windows registry.1 2

created 2017-12-142 referencesaka SeaLotus

All 3 groups for this technique

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

StrelaStealerS1183 ↗

Enumerates the registry key HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\ to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.1 2 3

created 2024-12-31MALWARE

IceAppleS1022 ↗

Can harvest credentials from local and remote host registries.1

created 2022-06-27MALWARE

ValakS0476 ↗

Can use the clientgrabber module to steal e-mail credentials from the Registry.1

created 2020-06-19MALWAREcarried by 1 group

Agent TeslaS0331 ↗

Has the ability to extract credentials from the Registry.1

created 2019-01-29MALWAREcarried by 2 groups

TrickBotS0266 ↗

Has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key 1

created 2018-10-17MALWAREcarried by 2 groups

PowerSploitS0194 ↗

Has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.1

created 2018-04-18TOOLcarried by 9 groups

All 7 software entries for this technique · 6 newest in this preview

Offense vs defense T1552.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 3

first rule: 2019 Q3

Credentials in Registry detection strategy DET0250

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Credential Discovery via Windows Registry Enumeration

Enterprise

1 platform

AN0694 · Windows

Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key AccessDC0050	EDR:hunting	Behavioral rule for registry enumeration under credential-related paths
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KeywordMatch	List of strings searched in registry queries (e.g., password, credential, login). May need to expand for localized OS or app-specific terms.
ParentProcessFilter	Parent process used for registry access. Can tune for suspicious ancestry (e.g., cmd.exe > reg.exe vs. services.exe > reg.exe).
TimeWindow	Time-based correlation window for detecting chained activity between registry reads and subsequent credential use or exfiltration.
RegistryHiveScope	HKLM vs. HKCU vs. others. May limit scope to user or system context depending on risk appetite.

1 analytic

Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as PowerSploit in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality.

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
  cred_processes = filter processes where (
  command_line = "*reg* query HKLM /f password /t REG_SZ /s*" OR
  command_line = "reg* query HKCU /f password /t REG_SZ /s" OR
  command_line = "*Get-UnattendedInstallFile*" OR
  command_line = "*Get-Webconfig*" OR
  command_line = "*Get-ApplicationHost*" OR
  command_line = "*Get-SiteListPassword*" OR
  command_line = "*Get-CachedGPPPassword*" OR
  command_line = "*Get-RegistryAutoLogon*")
output cred_processes

This Splunk search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.

((index=__your_sysmon_index__ EventCode=1) OR (index=__your_win_syslog_index__ EventCode=4688)) (CommandLine="*reg* query HKLM /f password /t REG_SZ /s*" OR CommandLine="reg* query HKCU /f password /t REG_SZ /s" OR CommandLine="*Get-UnattendedInstallFile*" OR CommandLine="*Get-Webconfig*" OR CommandLine="*Get-ApplicationHost*" OR CommandLine="*Get-SiteListPassword*" OR CommandLine="*Get-CachedGPPPassword*" OR CommandLine="*Get-RegistryAutoLogon*")

This LogPoint search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.

norm_id=WindowsSysmon event_id=1 command IN ["*reg* query HKLM /f password /t REG_SZ /s*", "reg* query HKCU /f password /t REG_SZ /s", "*Get-UnattendedInstallFile*", "*Get-Webconfig*", "*Get-ApplicationHost*", "*Get-SiteListPassword*", "*Get-CachedGPPPassword*", "*Get-RegistryAutoLogon*"]

Tests2Executorscmd 2Need elevation0 of 2Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Enumeration for Credentials in Registry	windows	cmd	—	—	—
Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed. Attack command reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s GUID27cba375-69a3-4df1-bcdd-b486aa2da981
02	Enumeration for PuTTY Credentials in Registry	windows	cmd	—	—	—
Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry entries are found, they will be displayed. Attack command reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s GUID9b15653c-d84b-43f4-82e0-54b34b60599f

Tests from Atomic Red Team (MIT licence) · technique definition

Credentials in Registry detections T1552.002

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs