Detectionmediumtest

Weak or Abused Passwords In CLI

Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Wed Sep 14Updated Fri Feb 2391edcfb1-2529-4ac2-9ecc-7617f895c7e4windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains:
            # Add more passwords
            - '123456789'
            - '123123qwE'
            - 'Asd123.aaaa'
            - 'Decryptme'
            - 'P@ssw0rd!'
            - 'Pass8080'
            - 'password123' # Also covers PASSWORD123123! as seen in https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/
            - 'test@202' # Covers multiple years
    condition: selection