Registry Queried for Stored Credentials Remotely

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.