Unsecured Credentials: Credentials in Registry
- ID
- T1552.002
- Tactics
- TA0006 Credential Access
- Sub-technique of
- T1552 Unsecured Credentials
- Platforms
- Windows
- Data sources
- Process Creation, Windows Registry Key Modification, Windows Registry Key Access
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information: [1]
- Local Machine Hive:
reg query HKLM /f password /t REG_SZ /s - Current User Hive:
reg query HKCU /f password /t REG_SZ /s
Detection
- DET0250 Detect Credential Discovery via Windows Registry Enumeration
Data components: Process Creation, Windows Registry Key Modification, Windows Registry Key Access
Mitigations (3)
- M1026 Privileged Account Management
If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.
- M1027 Password Policies
Do not store credentials within the Registry.
- M1047 Audit
Proactively search for credentials within the Registry and attempt to remediate the risk.
Groups (3)
Software (7)
- S0075 Reg
- S0194 PowerSploit
- S0266 TrickBot
- S0331 Agent Tesla
- S0476 Valak
- S1022 IceApple
- S1183 StrelaStealer