Enumeration of Third-Party Application Credentials from Command Line
This rule detects processes that query known third-party application registry keys that are known to store credentials. The detection specifically looks for command-line arguments containing paths to registry keys associated with applications like Foxmail, DownloadManager, CoreFTP, IncrediMail, WinSCP, MobaXterm, OpenSSH, OpenVPN, Radmin, Eudora, RealVNC, B2, PuTTY, and TightVNC. This activity often indicates an adversary attempting to discover or extract credentials stored by these applications.
Sigma
