Suspicious Credential Search with findstr/reg

Ankit Mehta@Secvyn

•updated Jun 5, 2026•2•0•6

This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.