Detectionmediumtest

New Generic Credentials Added Via Cmdkey.EXE

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Fri Feb 03Updated Tue Mar 05b1ec66c6-f4d1-4b5c-96dd-af28ccae7727windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\cmdkey.exe'
        - OriginalFileName: 'cmdkey.exe'
    selection_cli_generic:
        CommandLine|contains|windash: ' -g' # Generic
    selection_cli_user:
        CommandLine|contains|windash: ' -u' # User
    selection_cli_password:
        CommandLine|contains|windash: ' -p' # Password
    condition: all of selection_*