AutoLogons Access Attempt via Registry

[rule]
description = """
Identifies attempts to access AutoLogons credentials via registry value query. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "c0a977b4-1342-4794-9cd2-5d726c26c1b9"
license = "Elastic License v2"
name = "AutoLogons Access Attempt via Registry"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/SharpUp/blob/master/SharpUp/Checks/RegistryAutoLogons.cs#L26"]
version = "1.0.17"

query = '''
registry where event.action == "query" and process.executable != null and
 registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword" and
 not process.executable :
            ("?:\\Windows\\System32\\LogonUI.exe",
             "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
             "?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
             "?:\\$WINDOWS.~BT\\Sources\\WindowsUpdateBox.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\System32\\MusNotification.exe", 
             "?:\\Windows\\SysWOW64\\MusNotification.exe",
             "?:\\Windows\\System32\\wsmprovhost.exe",
             "?:\\Windows\\System32\\conhost.exe",
             "?:\\Windows\\System32\\SecurityHealthSystray.exe",
             "?:\\Windows\\System32\\reg.exe",
             "?:\\Windows\\regedit.exe", 
             "?:\\Program Files\\*.exe", 
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\cmd.exe",
             "C:\\ProgramData\\Guardicore\\utils\\gc-insight.exe",
             "?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell.exe", 
             "?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell_ise.exe",
             "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCmdRun.exe",
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
             "?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe",
             "?:\\Windows\\Temp\\MSS\\IRTKDeploy\\fennec-windows-x64.exe",
             "\\Device\\Mup\\*\\Autologon.exe",
             "?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\emulator\\MmrAgent.NetFxEmulator.exe") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
  not (process.name : "Autologon.exe" and process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.6.0"