AutoLogon Credentials Read from Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.