Crypto Wallet Registry Enumeration by Non-Wallet Process (T1012/T1552.002)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.