Registry queried for credential-related value names

Siemphony@siemphonymediumT1552.002unverified

Matches a command line that both names a registry-read verb against a local or current-user hive and carries a credential-related keyword, which is AN0694's "command-line executions or API-based registry reads targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'" — the tool and hive gates come straight from the brief's example commands (`reg query HKLM /f password /t REG_SZ /s`, `reg query HKCU /f password /t REG_SZ /s`). MITRE's KeywordMatch knob is populated here with password, passwd, pwd, credential, cred and logon; the brief names the knob, this list is authored, not sourced from MITRE. This is distinct from the published T1012 rule, which matches reg query and the PowerShell registry cmdlets against host/software/security keys and explicitly excludes any credential keyword — the two rules cannot overlap because T1012's key list contains no password-related term. ParentProcessFilter and TimeWindow are not encoded; this is a single process_creation event with no ancestry gate and no correlation to subsequent credential use. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0250, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((ProcessCommandLine contains "reg query" or ProcessCommandLine contains "reg.exe query" or ProcessCommandLine contains "Get-ItemProperty" or ProcessCommandLine contains "Get-ItemPropertyValue") and (ProcessCommandLine contains "HKLM" or ProcessCommandLine contains "HKCU" or ProcessCommandLine contains "HKEY_LOCAL_MACHINE" or ProcessCommandLine contains "HKEY_CURRENT_USER")) and (ProcessCommandLine contains "password" or ProcessCommandLine contains "passwd" or ProcessCommandLine contains "pwd" or ProcessCommandLine contains "credential" or ProcessCommandLine contains "cred" or ProcessCommandLine contains "logon"))

Splunk · SPL

Run this as a search.

index=* (((CommandLine="*reg query*" OR CommandLine="*reg.exe query*" OR CommandLine="*Get-ItemProperty*" OR CommandLine="*Get-ItemPropertyValue*") AND (CommandLine="*HKLM*" OR CommandLine="*HKCU*" OR CommandLine="*HKEY_LOCAL_MACHINE*" OR CommandLine="*HKEY_CURRENT_USER*")) AND (CommandLine="*password*" OR CommandLine="*passwd*" OR CommandLine="*pwd*" OR CommandLine="*credential*" OR CommandLine="*cred*" OR CommandLine="*logon*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.command_line) LIKE "*reg query*" OR TO_LOWER(process.command_line) LIKE "*reg.exe query*" OR TO_LOWER(process.command_line) LIKE "*get-itemproperty*" OR TO_LOWER(process.command_line) LIKE "*get-itempropertyvalue*") AND (TO_LOWER(process.command_line) LIKE "*hklm*" OR TO_LOWER(process.command_line) LIKE "*hkcu*" OR TO_LOWER(process.command_line) LIKE "*hkey_local_machine*" OR TO_LOWER(process.command_line) LIKE "*hkey_current_user*")) AND (TO_LOWER(process.command_line) LIKE "*password*" OR TO_LOWER(process.command_line) LIKE "*passwd*" OR TO_LOWER(process.command_line) LIKE "*pwd*" OR TO_LOWER(process.command_line) LIKE "*credential*" OR TO_LOWER(process.command_line) LIKE "*cred*" OR TO_LOWER(process.command_line) LIKE "*logon*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(reg query|reg\.exe query|Get-ItemProperty|Get-ItemPropertyValue)</field>    <field name="CommandLine" type="pcre2">(?i)(HKLM|HKCU|HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER)</field>    <field name="CommandLine" type="pcre2">(?i)(password|passwd|pwd|credential|cred|logon)</field>    <description>Registry queried for credential-related value names</description>    <mitre>      <id>T1552.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 21677283-afa1-4adb-b7f5-54982707040b

ATT&CKT1552.002

T1552.002Credentials in Registry

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

This rule catches the discovery step, not credential theft itself: a single process whose command line names a registry-read verb, targets a local or current-user hive, and carries a credential-related word, all at once. That's a close paraphrase of AN0694 — "command-line executions ... targeting sensitive paths like HKLM or HKCU with keyword filters such as 'password', 'cred', or 'logon'" — and the tool/hive gates trace directly to the brief's own example commands, reg query HKLM /f password /t REG_SZ /s and the HKCU variant. Nothing here observes what happens to the value once it's read: no ancestry, no time window, no link to subsequent use. It's a precursor-only detection of the query itself, one process_creation event and nothing more.

02 · Telemetry you need

Sysmon EventID 1 (process_creation, windows), CommandLine field populated. If your pipeline routes this rule through the Sentinel translator instead, it lands on SecurityEvent | where EventID == 4688 — and 4688's CommandLine column is empty unless Audit Process Creation and the separate Include command line in process creation events policy are both turned on, neither of which is a default setting. The rule is authored against Sysmon; treat the Security-log rendering as needing that extra prerequisite, not as an equivalent feed you already have.

03 · How the logic works

Three selections, all required (selection_tool and selection_hive and selection_keyword): - selection_tool: CommandLine contains reg query, reg.exe query, Get-ItemProperty, or Get-ItemPropertyValue - selection_hive: CommandLine contains HKLM, HKCU, HKEY_LOCAL_MACHINE, or HKEY_CURRENT_USER - selection_keyword: CommandLine contains password, passwd, pwd, credential, cred, or logon Each is a plain substring test on the same CommandLine string — there's no ordering or proximity constraint between them. A long or chained command line could technically satisfy all three without the tool, hive, and keyword being logically related the way the rule's description implies; that's a known limitation of Sigma's substring matching, not a bug.

04 · Common false positives

The first two false-positive entries are solid and worth internalizing: administrators running the exact audit command MITRE documents as a hardening check, and helpdesk staff querying AutoAdminLogon or saved RDP/VPN credential settings where the value name itself (DefaultPassword, SavedPassword) satisfies the keyword gate.
The third entry, though, is a teaching example of a subtler mistake: it claims a script calling Get-ItemProperty "broadly across a policy tree" will "incidentally match" on a returned value name like PasswordExpiryWarning. That can't happen — selection_keyword gates on the command line text, not on data the cmdlet returns. A genuinely broad sweep (Get-ItemProperty -Path X with no -Name) never puts "password" in the command line, so it never fires. For this FP to be real, the script would have to name the property explicitly, e.g. -Name PasswordExpiryWarning, right there in the invocation. Read this as a caution: a plausible-sounding false positive still has to survive the rule's actual field logic, not just the scenario's narrative.

05 · Detection maturity

tier_1: UNVERIFIED — lowest tier. This rule has never been executed against real logs, only authored from the MITRE brief and checked by static review. Treat it as a starting scaffold to test and tune, not a proven detection.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's KeywordMatch knob names the idea of a credential-word list; the six terms actually in the rule (password, passwd, pwd, credential, cred, logon) are the rule author's own choice, not MITRE's. MITRE's ParentProcessFilter, TimeWindow, and RegistryHiveScope knobs are all left untouched — both hives are included with no scoping, and there's no ancestry or time correlation.
The rule also has an unstated evasion gap: -EncodedCommand/-Enc PowerShell invocations put none of these literal strings in the visible CommandLine, and reg save/reg export/reg copy can pull the same values without ever containing "query" — both bypass every selection outright. A quiet result from this rule does not mean nothing was queried.

Declared by the author

Administrators or scheduled compliance scripts running the exact audit command the brief itself documents — reg query HKLM /f password /t REG_SZ /s — to hunt for insecurely stored credentials as a hardening check rather than an attack.
Helpdesk troubleshooting of AutoAdminLogon or RDP/VPN client saved-credential settings, where an operator queries Winlogon or a client's settings key and the value names DefaultPassword or SavedPassword satisfy the keyword gate.
PowerShell configuration or inventory modules that call Get-ItemProperty broadly across a policy or application settings tree, incidentally matching a value name such as PasswordExpiryWarning or PasswordLastSet with no credential-hunting intent.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Credentials in the registry (AutoAdminLogon)
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1552.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/21677283-afa1-4adb-b7f5-54982707040b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Registry queried for credential-related value names

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it