Hunt - Windows Modify registry to store logon credentials (T1112)

Danny Y@zendannyy

•updated Jun 29, 2026•0•0•0

Hunting rule loosely based off of Atomic Red Team T1112 test "Modify registry to store logon credentials". No public in-the-wild intel reference available; correlate before alerting.