Credentials in Registry is a credential access technique on Windows, tracked by MITRE as T1552.002 under Unsecured Credentials.
How attackers use it
The Windows Registry stores configuration for the system and for programs. Some of those programs save credentials there, and sometimes the values are used for automatic logons. An adversary on a compromised system can query the Registry looking for them.
MITRE gives example queries that search the local machine and current user hives for the word password in string values, using reg query with a /f password filter and /t REG_SZ /s to recurse. The technique is quiet and uses a built-in tool.
How to detect it
MITRE's detection strategy watches command lines and API reads that target sensitive paths in HKLM or HKCU with keyword filters such as password, cred or logon. These come from reg.exe, PowerShell, custom binaries or offensive tooling. Process ancestry and command line arguments tell you whether it was an admin troubleshooting or something else.
How to reduce the risk
MITRE lists three mitigations.
- Audit: proactively search the Registry for credentials and fix what you find.
- Password policies: do not store credentials in the Registry.
- Privileged account management: where software must store credentials there, give the account only limited permissions so it is of little use if taken.
Quick check
Which tool does MITRE show for searching the Registry for passwords?
The built-in reg query command, filtered on the word password and run against the HKLM and HKCU hives.
Sources
- MITRE ATT&CK, Unsecured Credentials: Credentials in Registry: https://attack.mitre.org/techniques/T1552/002
