Registry Credential Hunting via SMB - Credential Registry Keys T1012 T1552.002

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.