Detectionhightest
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Detects usage of cmdkey to look for cached credentials on the system
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)Created Wed Jan 16Updated Tue Mar 0507f8bdc2-c9b3-472a-9817-5a670b872f53windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_img:
- Image|endswith: '\cmdkey.exe'
- OriginalFileName: 'cmdkey.exe'
selection_cli:
CommandLine|contains|windash: ' -l'
condition: all of selection*False Positives
Legitimate administrative tasks
Testing & Validation
Simulations
atomic-red-teamT1003.005
View on ARTCached Credential Dump via Cmdkey
GUID: 56506854-89d6-46a3-9804-b7fde90791f9
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
07f8bdc2-c9b3-472a-9817-5a670b872f53
Status
test
Level
high
Type
Detection
Created
Wed Jan 16
Modified
Tue Mar 05
Path
rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml
Raw Tags
attack.credential-accessattack.t1003.005