Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Detects usage of cmdkey to look for cached credentials on the system
Sigma rule (View on GitHub)
1title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
2id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
3status: test
4description: Detects usage of cmdkey to look for cached credentials on the system
5references:
6 - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
7 - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
8 - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
9author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
10date: 2019-01-16
11modified: 2024-03-05
12tags:
13 - attack.credential-access
14 - attack.t1003.005
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection_img:
20 - Image|endswith: '\cmdkey.exe'
21 - OriginalFileName: 'cmdkey.exe'
22 selection_cli:
23 CommandLine|contains|windash: ' -l'
24 condition: all of selection*
25fields:
26 - CommandLine
27 - ParentCommandLine
28 - User
29falsepositives:
30 - Legitimate administrative tasks
31level: high
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Cred Dump Tools Dropped Files
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- Dumping of Sensitive Hives Via Reg.EXE
- HackTool - Credential Dumping Tools Named Pipe Created