attack_technique: T1552.002
display_name: 'Unsecured Credentials: Credentials in Registry'
atomic_tests:
- name: Enumeration for Credentials in Registry
  auto_generated_guid: b6ec082c-7384-46b3-a111-9a9b8b14e5e7
  description: |
    Queries to enumerate for credentials in the Registry. Upon execution, any registry key containing the word "password" will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      reg query HKLM /f password /t REG_SZ /s
      reg query HKCU /f password /t REG_SZ /s
    name: command_prompt
- name: Enumeration for PuTTY Credentials in Registry
  auto_generated_guid: af197fd7-e868-448e-9bd5-05d1bcd9d9e5
  description: |
    Queries to enumerate for PuTTY credentials in the Registry. PuTTY must be installed for this test to work. If any registry
    entries are found, they will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s
    name: command_prompt