Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

calendar Aug 12, 2024 · attack.credential-access attack.t1003.005  ·
Share on: linkedin copy

Detects usage of cmdkey to look for cached credentials on the system

Sigma rule (View on GitHub)

 1title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
 2id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
 3status: test
 4description: Detects usage of cmdkey to look for cached credentials on the system
 5references:
 6    - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
 7    - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
 8    - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
 9author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
10date: 2019-01-16
11modified: 2024-03-05
12tags:
13    - attack.credential-access
14    - attack.t1003.005
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_img:
20        - Image|endswith: '\cmdkey.exe'
21        - OriginalFileName: 'cmdkey.exe'
22    selection_cli:
23        CommandLine|contains|windash: ' -l'
24    condition: all of selection*
25fields:
26    - CommandLine
27    - ParentCommandLine
28    - User
29falsepositives:
30    - Legitimate administrative tasks
31level: high

References

Related rules

to-top