attack.t1552.002

SAM Registry Hive Handle Request

Nov 24, 2025 · attack.discovery attack.t1012 attack.credential-access attack.t1552.002 ·

Share on:

Detects handles requested to SAM registry hive

Enumeration for 3rd Party Creds From CLI

May 26, 2025 · attack.credential-access attack.t1552.002 ·

Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Registry Export of Third-Party Credentials

May 26, 2025 · attack.credential-access attack.t1552.002 ·

Share on:

Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.

Enumeration for Credentials in Registry

Aug 12, 2024 · attack.credential-access attack.t1552.002 ·

Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services