Query: detection rule: Detects processes that query known 3rd party registry keys that holds credentials via commandline
Matching passage: Sigma rule: Detects processes that query known 3rd party registry keys that holds credentials via commandline. Logsource: windows / process_creation. Rule: title: Enumeration for 3rd Party Creds From CLI id: 87a476dc-0079-4583-a985-dee7a20a03de related: - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 type: derived - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 type: similar status: test description: Detects processes that query known 3rd party registry keys that holds credentials via commandline references: - https://isc.sans.edu/diary/More+Data+Exfiltration/25698 - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm\ - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys\ - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin filter_main_other_rule: Image|endswith: reg.exe CommandLine|contains: - export - save condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lat. Logsource: zeek / smb_files. Rule: title: First Time Seen Remote Named Pipe - Zeek id: 021310d9-30a6-480a-84b7-eaa69aeb92bb related: - id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad type: derived status: test description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes references: - https://twitter.com/menasec1/status/1104489274387451904 author: Samir Bousseaden, @neu5ron, Tim Shelton date: 2020-04-02 modified: 2022-12-27 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: zeek service: smb_files detection: selection: path: \\\\\*\\IPC$ filter_keywords: - samr - lsarpc - winreg - netlogon - srvsvc - protected_storage - wkssvc - browser - netdfs - svcctl - spoolss - ntsvcs - LSM_API_service - HydraLsPipe - TermSrv_API_service - MsFteWds condition: selection and not 1 of filter_* falsepositives: - Update the excluded named pipe to filter out any newly observed legit named pipe level: high