T1552.002 Unsecured Credentials: Credentials in Registry

Adversaries may search the Registry on compromised systems for insecurely stored credentials. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1552.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1552Unsecured Credentials

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highRegistry Export of Third-Party CredentialsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumEnumeration for 3rd Party Creds From CLINasreddine Bencherchali (Nextron Systems) · Windows