Query: Sigma rule for Detects processes that query known 3rd party registry keys that holds credentials via commandline
Matching passage: Sigma rule: Detects processes that query known 3rd party registry keys that holds credentials via commandline. Logsource: windows / process_creation. Rule: title: Enumeration for 3rd Party Creds From CLI id: 87a476dc-0079-4583-a985-dee7a20a03de related: - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 type: derived - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 type: similar status: test description: Detects processes that query known 3rd party registry keys that holds credentials via commandline references: - https://isc.sans.edu/diary/More+Data+Exfiltration/25698 - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm\ - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys\ - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin filter_main_other_rule: Image|endswith: reg.exe CommandLine|contains: - export - save condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines. Logsource: windows / process_creation. Rule: title: Suspicious Obfuscated PowerShell Code id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35 status: test description: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines references: - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/ author: Florian Roth (Nextron Systems) date: 2022-07-11 modified: 2023-02-14 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IAAtAGIAeABvAHIAIAAwAHgA - AALQBiAHgAbwByACAAMAB4A - gAC0AYgB4AG8AcgAgADAAeA - AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg - AuAEkAbgB2AG8AawBlACgAKQAgAHwAI - ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC - AHsAMQB9AHsAMAB9ACIAIAAtAGYAI - B7ADEAfQB7ADAAfQAiACAALQBmAC - AewAxAH0AewAwAH0AIgAgAC0AZgAg - AHsAMAB9AHsAMwB9ACIAIAAtAGYAI - B7ADAAfQB7ADMAfQAiACAALQBmAC - AewAwAH0AewAzAH0AIgAgAC0AZgAg - AHsAMgB9AHsAMAB9ACIAIAAtAGYAI - B7ADIAfQB7ADAAfQAiACAALQBmAC - AewAyAH0AewAwAH0AIgAgAC0AZgAg - AHsAMQB9AHsAMAB9ACcAIAAtAGYAI - B7ADEAfQB7ADAAfQAnACAALQBmAC - AewAxAH0AewAwAH0AJwAgAC0AZgAg - AHsAMAB9AHsAMwB9ACcAIAAtAGYAI - B7ADAAfQB7ADMAfQAnACAALQBmAC - AewAwAH0AewAzAH0AJwAgAC0AZgAg - AHsAMgB9AHsAMAB9ACcAIAAtAGYAI - B7ADIAfQB7ADAAfQAnACAALQBmAC - AewAyAH0AewAwAH0AJwAgAC0AZgAg condition: selection falsepositives: - Unknown level: high