Registry Export of Third-Party Credentials

Title: Registry Export of Third-Party Credentials
Status: experimental
Description:Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.
References:
  -https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1552.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_cli_save:
    CommandLine|contains:
      -'save'
      -'export'

  selection_cli_path:
    CommandLine|contains:
      -'\Software\Aerofox\Foxmail\V3.1'
      -'\Software\Aerofox\FoxmailPreview'
      -'\Software\DownloadManager\Passwords'
      -'\Software\FTPWare\COREFTP\Sites'
      -'\Software\IncrediMail\Identities'
      -'\Software\Martin Prikryl\WinSCP 2\Sessions'
      -'\Software\Mobatek\MobaXterm'
      -'\Software\OpenSSH\Agent\Keys'
      -'\Software\OpenVPN-GUI\configs'
      -'\Software\ORL\WinVNC3\Password'
      -'\Software\Qualcomm\Eudora\CommandLine'
      -'\Software\RealVNC\WinVNC4'
      -'\Software\RimArts\B2\Settings'
      -'\Software\SimonTatham\PuTTY\Sessions'
      -'\Software\SimonTatham\PuTTY\SshHostKeys'
      -'\Software\Sota\FFFTP'
      -'\Software\TightVNC\Server'
      -'\Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high