Credentials in Files & Registry

Hypothesis and description

Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as PowerSploit in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality.

Platforms: Windows
Domain: Host
Subtypes: Process, Registry
Submitted: 2020-09-10
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1552 Unsecured CredentialsT1552.001, T1552.002	Credential Access	Low

1 technique, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1552Unsecured Credentials
.001 Credentials In Files .002 Credentials in Registry

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/command_line

Pseudocode and implementations

PseudocodePseudocode - reg.exe password search & powersploit modulesData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
  cred_processes = filter processes where (
  command_line = "*reg* query HKLM /f password /t REG_SZ /s*" OR
  command_line = "reg* query HKCU /f password /t REG_SZ /s" OR
  command_line = "*Get-UnattendedInstallFile*" OR
  command_line = "*Get-Webconfig*" OR
  command_line = "*Get-ApplicationHost*" OR
  command_line = "*Get-SiteListPassword*" OR
  command_line = "*Get-CachedGPPPassword*" OR
  command_line = "*Get-RegistryAutoLogon*")
output cred_processes

SplunkSplunk Search - reg.exe password search & powersploit modulesData model: Sysmon native

This Splunk search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.

((index=__your_sysmon_index__ EventCode=1) OR (index=__your_win_syslog_index__ EventCode=4688)) (CommandLine="*reg* query HKLM /f password /t REG_SZ /s*" OR CommandLine="reg* query HKCU /f password /t REG_SZ /s" OR CommandLine="*Get-UnattendedInstallFile*" OR CommandLine="*Get-Webconfig*" OR CommandLine="*Get-ApplicationHost*" OR CommandLine="*Get-SiteListPassword*" OR CommandLine="*Get-CachedGPPPassword*" OR CommandLine="*Get-RegistryAutoLogon*")

LogPointLogPoint search - reg.exe password search & powersploit modulesData model: LogPoint native

This LogPoint search looks for command lines of reg.exe used to search for passwords, as well as those of powersploit modules for the same purpose.

norm_id=WindowsSysmon event_id=1 command IN ["*reg* query HKLM /f password /t REG_SZ /s*", "reg* query HKCU /f password /t REG_SZ /s", "*Get-UnattendedInstallFile*", "*Get-Webconfig*", "*Get-ApplicationHost*", "*Get-SiteListPassword*", "*Get-CachedGPPPassword*", "*Get-RegistryAutoLogon*"]

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

View CAR-2020-09-004 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1552 Unsecured CredentialsT1552.001, T1552.002

Credential Access

Low