Query: rule covering Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be
Matching passage: Sigma rule: Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be. Logsource: windows / process_creation. Rule: title: Registry Export of Third-Party Credentials id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 related: - id: 87a476dc-0079-4583-a985-dee7a20a03de type: similar status: experimental description: 'Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry. ' references: - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_save: CommandLine|contains: - save - export selection_cli_path: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in. Logsource: windows / process_creation. Rule: title: Capture Credentials with Rpcping.exe id: 93671f99-04eb-4ab4-a161-70d446a84003 status: test description: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. references: - https://lolbas-project.github.io/lolbas/Binaries/Rpcping/ - https://twitter.com/vysecurity/status/974806438316072960 - https://twitter.com/vysecurity/status/873181705024266241 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11) author: Julia Fomina, oscd.community date: 2020-10-09 modified: 2025-10-31 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_main_img: - Image|endswith: \RpcPing.exe - OriginalFileName: \RpcPing.exe selection_main_flag: CommandLine|contains|windash: -s selection_cli_ntlm: CommandLine|contains|windash: -u CommandLine|contains: NTLM selection_cli_ncacn: CommandLine|contains|windash: -t CommandLine|contains: ncacn_np condition: all of selection_main_* and 1 of selection_cli_* falsepositives: - Unlikely level: medium