May this cmd for password query could find into a content update?

[RFeyertag]

https://twitter.com/VirtualAllocEx/status/1599048829084794880?s=20&t=V1OyrvuCbhYez-wkSXNk1A

Or ist there a rule ready for this?

BR

Rob

[mavraham]

Dear @RFeyertag 

Thank you for writing to XDR live community!

You can create your own custom BIOC rule to detect this attempt to discover unsecured credentials in the registry.

1. Start by logging in to your XDR tenant and Choose Detection Rules → BIOC
2. In the BIOC rules page choose ‘add BIOC’ at the top right of your screen.
3.  Next, select to create a Process based BIOC and apply the following filters:
1. name = reg.exe
2. cmd =~.*query.*password.*
4. Click ‘Save’.
5. You will now be prompted to name your new BIOC rule and, choose: type, severity level and associated MITRE techniques and tactics:
1. Type:‘Credentials Access’.
2. Technique:T1214 - Credentials in Registry
3. Tactic: TA0006 - Credential Access
6. Click save.
   
   
   Attaching screenshots below for your convenience .
   You should now have a custom BIOC to help you discover potential attempts to unsecure credentials in the registry.
   
   Hope this helps!