Credentials in Registry (Windows Event Log)

id: '6135.6624'
title: Credentials in Registry
description: 'Adversaries may search the Registry on compromised systems for insecurely
  stored credentials. The Windows Registry stores configuration information that can
  be used by the system or other programs. -- Threat Actor Association: Antlion, APT10/Cicada,
  APT27/Emissary Panda, APT41, Flax Typhoon, Lancefly, Lazarus, Mustang Panda (aka.
  Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA428, Tropic
  Trooper, Volt Typhoon - Software Association: Akira, AZORLUT, Blackcat/ALPHV, CL-STA-0043,
  DatopLoader, Diavol, Play, PYSA/Mespinoza, QAKBOT, Ransom Cartel, Rhysida, TorrentLocker,
  Tricky Pyxie, Yanluowang -- Atomics T1003.002 Test #1 Atomics T1003.003 Test #2
  Atomics T1003.004 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(reg) AND TERM(query) AND ((TERM(HKLM) OR
  TERM(HKCU)) AND TERM(password) AND TERM(REG_SZ)) OR TERM(Winlogon) OR TERM(SNMP)
  OR TERM(Sessions) OR (TERM(WinVNC4) AND TERM(password))) OR (TERM(reg) AND TERM(save)
  AND (TERM(system) OR TERM(SAM) OR TERM(security))) | table _time, host, user, process,
  process_*, parent_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf
- https://assets.sentinelone.com/labs/sentinel-one-valak-i