1. Home
  2. ATT&CK Techniques
  3. T1552.002 Credentials in Registry

T1552.002 Credentials in Registry

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.

Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

  • Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code>
  • Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.06 Production environment segregation Mitigates T1552.002 Credentials in Registry
Comments
This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
References
    PR.AA-05.02 Privileged system access Mitigates T1552.002 Credentials in Registry
    Comments
    This diagnostic statement protects against Credentials in Registry through the use of privileged account management and the use of multi-factor authentication.
    References
      DE.CM-06.02 Third-party access monitoring Mitigates T1552.002 Credentials in Registry
      Comments
      This diagnostic statement protects against Credentials in Registry through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
      References
        PR.IR-01.05 Remote access protection Mitigates T1552.002 Credentials in Registry
        Comments
        This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
        References
          PR.AA-01.01 Identity and credential management Mitigates T1552.002 Credentials in Registry
          Comments
          This diagnostic statement protects against Credentials in Registry through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
          References

            NIST 800-53 Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            CA-07 Continuous Monitoring mitigates T1552.002 Credentials in Registry
            CM-06 Configuration Settings mitigates T1552.002 Credentials in Registry
            CM-05 Access Restrictions for Change mitigates T1552.002 Credentials in Registry
            IA-05 Authenticator Management mitigates T1552.002 Credentials in Registry
            AC-17 Remote Access mitigates T1552.002 Credentials in Registry
            SC-12 Cryptographic Key Establishment and Management mitigates T1552.002 Credentials in Registry
            SA-15 Development Process, Standards, and Tools mitigates T1552.002 Credentials in Registry
            SC-28 Protection of Information at Rest mitigates T1552.002 Credentials in Registry
            SC-04 Information in Shared System Resources mitigates T1552.002 Credentials in Registry
            RA-05 Vulnerability Monitoring and Scanning mitigates T1552.002 Credentials in Registry
            CM-02 Baseline Configuration mitigates T1552.002 Credentials in Registry
            SA-11 Developer Testing and Evaluation mitigates T1552.002 Credentials in Registry
            IA-02 Identification and Authentication (Organizational Users) mitigates T1552.002 Credentials in Registry
            SI-04 System Monitoring mitigates T1552.002 Credentials in Registry
            AC-02 Account Management mitigates T1552.002 Credentials in Registry
            AC-03 Access Enforcement mitigates T1552.002 Credentials in Registry
            AC-05 Separation of Duties mitigates T1552.002 Credentials in Registry
            AC-06 Least Privilege mitigates T1552.002 Credentials in Registry

            VERIS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1552.002 Credentials in Registry
            attribute.confidentiality.data_disclosure None related-to T1552.002 Credentials in Registry

            Azure Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1552.002 Credentials in Registry
            Comments
            This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and RegistryAutoLogon modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal.
            References
            1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction

            AWS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            aws_secrets_manager AWS Secrets Manager technique_scores T1552.002 Credentials in Registry
            Comments
            This control may prevent harvesting of unsecured credentials by removing credentials and secrets from applications and configuration files and requiring authenticated API calls to retrieve those credentials and secrets. This control is relevant for credentials stored in applications or configuration files but not credentials entered directly by a user.
            References