Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Detects usage of cmdkey to look for cached credentials on the system
Sigma rule (View on GitHub)
1title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
2id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
3status: experimental
4description: Detects usage of cmdkey to look for cached credentials on the system
5references:
6 - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
7 - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
8 - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
9author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
10date: 2019/01/16
11modified: 2023/02/03
12tags:
13 - attack.credential_access
14 - attack.t1003.005
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection_img:
20 - Image|endswith: '\cmdkey.exe'
21 - OriginalFileName: 'cmdkey.exe'
22 selection_cli:
23 CommandLine|contains:
24 - ' /l'
25 - ' -l'
26 condition: all of selection*
27fields:
28 - CommandLine
29 - ParentCommandLine
30 - User
31falsepositives:
32 - Legitimate administrative tasks
33level: high
References
-
In this post we look at how credentials cached via cmdkey.exe can be used as a method of privilege escalation on an internal penetration test.
Read More -
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More
Related rules
- Cred Dump Tools Dropped Files
- Credential Dumping Tools Service Execution
- Credential Dumping Tools Service Execution - Security
- Credential Dumping Tools Service Execution - System
- HackTool - Credential Dumping Tools Named Pipe Created