1. Home
  2. ATT&CK Techniques
  3. T1552.002 Credentials in Registry

T1552.002 Credentials in Registry Mappings

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.

Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)

  • Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code>
  • Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CA-07 Continuous Monitoring mitigates T1552.002 Credentials in Registry
CM-06 Configuration Settings mitigates T1552.002 Credentials in Registry
CM-05 Access Restrictions for Change mitigates T1552.002 Credentials in Registry
IA-05 Authenticator Management mitigates T1552.002 Credentials in Registry
AC-17 Remote Access mitigates T1552.002 Credentials in Registry
SC-12 Cryptographic Key Establishment and Management mitigates T1552.002 Credentials in Registry
SA-15 Development Process, Standards, and Tools mitigates T1552.002 Credentials in Registry
SC-28 Protection of Information at Rest mitigates T1552.002 Credentials in Registry
SC-04 Information in Shared System Resources mitigates T1552.002 Credentials in Registry
RA-05 Vulnerability Monitoring and Scanning mitigates T1552.002 Credentials in Registry
CM-02 Baseline Configuration mitigates T1552.002 Credentials in Registry
SA-11 Developer Testing and Evaluation mitigates T1552.002 Credentials in Registry
IA-02 Identification and Authentication (Organizational Users) mitigates T1552.002 Credentials in Registry
SI-04 System Monitoring mitigates T1552.002 Credentials in Registry
AC-02 Account Management mitigates T1552.002 Credentials in Registry
AC-03 Access Enforcement mitigates T1552.002 Credentials in Registry
AC-05 Separation of Duties mitigates T1552.002 Credentials in Registry
AC-06 Least Privilege mitigates T1552.002 Credentials in Registry

VERIS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1552.002 Credentials in Registry
attribute.confidentiality.data_disclosure None related-to T1552.002 Credentials in Registry

AWS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
aws_secrets_manager AWS Secrets Manager technique_scores T1552.002 Credentials in Registry
Comments
This control may prevent harvesting of unsecured credentials by removing credentials and secrets from applications and configuration files and requiring authenticated API calls to retrieve those credentials and secrets. This control is relevant for credentials stored in applications or configuration files but not credentials entered directly by a user.
References