Techniques › T1552.002 › AN0694
AN0694 Analytic 0694
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity.</p>
- Detects
- T1552.002 Credentials in Registry
- Part of
- DET0250 Detect Credential Discovery via Windows Registry Enumeration
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| EDR:hunting | Behavioral rule for registry enumeration under credential-related paths | DC0050 Windows Registry Key Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
KeywordMatch | List of strings searched in registry queries (e.g., password, credential, login). May need to expand for localized OS or app-specific terms. |
ParentProcessFilter | Parent process used for registry access. Can tune for suspicious ancestry (e.g., cmd.exe > reg.exe vs. services.exe > reg.exe). |
TimeWindow | Time-based correlation window for detecting chained activity between registry reads and subsequent credential use or exfiltration. |
RegistryHiveScope | HKLM vs. HKCU vs. others. May limit scope to user or system context depending on risk appetite. |