MITRE CAR unknown stable spl
Credentials in Files & Registry
Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as [PowerSploit](https://powersploit.readthedocs.io/en/latest/) in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality.
Detection Logic
((index=__your_sysmon_index__ EventCode=1)
OR (index=__your_win_syslog_index__ EventCode=4688)) (CommandLine="*reg* query HKLM /f password /t REG_SZ /s*"
OR CommandLine="reg* query HKCU /f password /t REG_SZ /s"
OR CommandLine="*Get-UnattendedInstallFile*"
OR CommandLine="*Get-Webconfig*"
OR CommandLine="*Get-ApplicationHost*"
OR CommandLine="*Get-SiteListPassword*"
OR CommandLine="*Get-CachedGPPPassword*"
OR CommandLine="*Get-RegistryAutoLogon*")Field Validations
Loading…
Comments (0)
Loading comments...