T1552.002sub-technique of T1552 Unsecured Credentials
Credentials in Registry
Windowsnothing on this site yetT1552.002 on attack.mitre.org
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Credential Discovery via Windows Registry Enumeration
- Defenders observe command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'. Typically performed by Reg.exe, PowerShell, custom binaries, or offensive tools such as Cobalt Strike.
what reduces it
- M1027 Password Policies. Do not store credentials within the Registry.
- M1026 Privileged Account Management. If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.
- M1047 Audit. Proactively search for credentials within the Registry and attempt to remediate the risk.