Techniques › T1552 › T1552.002

T1552.002 Credentials in Registry

credential access — Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0250 Detect Credential Discovery via Windows Registry Enumeration v1.0
  AN0694 Windows

  Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike. Correlation with process ancestry and command-line arguments indicates suspicious credential discovery activity.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  EDR:hunting Behavioral rule for registry enumeration under credential-related paths → DC0050 Windows Registry Key Access

  Tunable: KeywordMatch ParentProcessFilter TimeWindow RegistryHiveScope

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552.002

Rules tagged at the parent level (attack.t1552) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.